diff mbox series

[FFmpeg-devel] avformat/hls: update current segment reference before use

Message ID 20240317023628.1936-1-kasper93@gmail.com
State New
Headers show
Series [FFmpeg-devel] avformat/hls: update current segment reference before use | expand

Checks

Context Check Description
yinshiyou/make_loongarch64 success Make finished
yinshiyou/make_fate_loongarch64 success Make fate finished
andriy/make_x86 success Make finished
andriy/make_fate_x86 success Make fate finished

Commit Message

Kacper Michajłow March 17, 2024, 2:36 a.m. UTC 
It may be invalidated by the time it is used.

Fixes use after free when accessing current segment.

Fixes: #10825
---
 libavformat/hls.c | 3 +++
 1 file changed, 3 insertions(+)
diff mbox series

Patch

diff --git a/libavformat/hls.c b/libavformat/hls.c
index f6b44c2e35..94bc6bc064 100644
--- a/libavformat/hls.c
+++ b/libavformat/hls.c
@@ -2098,6 +2098,7 @@  static int hls_read_header(AVFormatContext *s)
          * If encryption scheme is SAMPLE-AES and audio setup information is present in external audio track,
          * use that information to find the media format, otherwise probe input data
          */
+        seg = current_segment(pls);
         if (seg && seg->key_type == KEY_SAMPLE_AES && pls->is_id3_timestamped &&
             pls->audio_setup_info.codec_id != AV_CODEC_ID_NONE) {
             void *iter = NULL;
@@ -2124,6 +2125,7 @@  static int hls_read_header(AVFormatContext *s)
             av_free(url);
         }
 
+        seg = current_segment(pls);
         if (seg && seg->key_type == KEY_SAMPLE_AES) {
             if (strstr(in_fmt->name, "mov")) {
                 char key[33];
@@ -2170,6 +2172,7 @@  static int hls_read_header(AVFormatContext *s)
          * on us if they want to.
          */
         if (pls->is_id3_timestamped || (pls->n_renditions > 0 && pls->renditions[0]->type == AVMEDIA_TYPE_AUDIO)) {
+            seg = current_segment(pls);
             if (seg && seg->key_type == KEY_SAMPLE_AES && pls->audio_setup_info.setup_data_length > 0 &&
                 pls->ctx->nb_streams == 1)
                 ret = ff_hls_senc_parse_audio_setup_info(pls->ctx->streams[0], &pls->audio_setup_info);