diff options
| author | André Draszik <git@andred.net> | 2015-10-20 09:13:04 +0100 |
|---|---|---|
| committer | Tim-Philipp Müller <tim@centricular.com> | 2015-10-25 09:26:34 +0000 |
| commit | e0b4290998d9a95553b7b6ad732891e3d1c8cc5b (patch) | |
| tree | 7ef1726965cced9902fb5b35ce085156c3f8bc7f /ext/hls/m3u8.c | |
| parent | 344d100b1c3e5ebfca6196caacb5a583624fdc85 (diff) | |
| download | gstreamer-plugins-bad-e0b4290998d9a95553b7b6ad732891e3d1c8cc5b.tar.gz | |
hlsdemux: don't crash or leak memory on broken master playlist
If a (master) playlist contains a variant list entry without a
URI then during parsing of the next variant list entry we are
a) leaking the entry we're currently parsing (new_list), and
b) free'ing the pointer to the previous list entry (list) without
updating the pointer.
Hence when then adding the URI for the latest parsed entry, incorrect
information is stored, as the information is used from 'list' which
is not valid memory anymore, also leading to crashes.
Fix this by correctly storing the new variant list entry pointer
as needed.
https://bugzilla.gnome.org/show_bug.cgi?id=756861
Diffstat (limited to 'ext/hls/m3u8.c')
| -rw-r--r-- | ext/hls/m3u8.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/ext/hls/m3u8.c b/ext/hls/m3u8.c index 18829f16c..7164ae2e9 100644 --- a/ext/hls/m3u8.c +++ b/ext/hls/m3u8.c @@ -583,10 +583,11 @@ gst_m3u8_update (GstM3U8Client * client, GstM3U8 * self, gchar * data, } else { self->iframe_lists = g_list_append (self->iframe_lists, new_list); } - } else if (list != NULL) { - GST_WARNING ("Found a list without a uri..., dropping"); - gst_m3u8_free (list); } else { + if (list != NULL) { + GST_WARNING ("Found a list without a uri..., dropping"); + gst_m3u8_free (list); + } list = new_list; } } else if (g_str_has_prefix (data_ext_x, "TARGETDURATION:")) { |