diff options
| author | André Draszik <git@andred.net> | 2015-10-20 09:13:04 +0100 |
|---|---|---|
| committer | Tim-Philipp Müller <tim@centricular.com> | 2015-10-25 10:58:20 +0000 |
| commit | b1fca495d772f69ed765d8638349e3104943792e (patch) | |
| tree | 8ec30dfd62131b4c51a0574b31c81dcb0a9e9c95 | |
| parent | abf3b98a4dc4bc9990836e1d9250b6848c3fbfbf (diff) | |
| download | gstreamer-plugins-bad-b1fca495d772f69ed765d8638349e3104943792e.tar.gz | |
hlsdemux: don't crash or leak memory on broken master playlist
If a (master) playlist contains a variant list entry without a
URI then during parsing of the next variant list entry we are
a) leaking the entry we're currently parsing (new_list), and
b) free'ing the pointer to the previous list entry (list) without
updating the pointer.
Hence when then adding the URI for the latest parsed entry, incorrect
information is stored, as the information is used from 'list' which
is not valid memory anymore, also leading to crashes.
Fix this by correctly storing the new variant list entry pointer
as needed.
https://bugzilla.gnome.org/show_bug.cgi?id=756861
| -rw-r--r-- | ext/hls/m3u8.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/ext/hls/m3u8.c b/ext/hls/m3u8.c index eca283b42..4265f9776 100644 --- a/ext/hls/m3u8.c +++ b/ext/hls/m3u8.c @@ -601,10 +601,11 @@ gst_m3u8_update (GstM3U8Client * client, GstM3U8 * self, gchar * data, } else { self->iframe_lists = g_list_append (self->iframe_lists, new_list); } - } else if (list != NULL) { - GST_WARNING ("Found a list without a uri..., dropping"); - gst_m3u8_free (list); } else { + if (list != NULL) { + GST_WARNING ("Found a list without a uri..., dropping"); + gst_m3u8_free (list); + } list = new_list; } } else if (g_str_has_prefix (data_ext_x, "TARGETDURATION:")) { |