From b1fca495d772f69ed765d8638349e3104943792e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Andr=C3=A9=20Draszik?= Date: Tue, 20 Oct 2015 09:13:04 +0100 Subject: hlsdemux: don't crash or leak memory on broken master playlist If a (master) playlist contains a variant list entry without a URI then during parsing of the next variant list entry we are a) leaking the entry we're currently parsing (new_list), and b) free'ing the pointer to the previous list entry (list) without updating the pointer. Hence when then adding the URI for the latest parsed entry, incorrect information is stored, as the information is used from 'list' which is not valid memory anymore, also leading to crashes. Fix this by correctly storing the new variant list entry pointer as needed. https://bugzilla.gnome.org/show_bug.cgi?id=756861 --- ext/hls/m3u8.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/ext/hls/m3u8.c b/ext/hls/m3u8.c index eca283b42..4265f9776 100644 --- a/ext/hls/m3u8.c +++ b/ext/hls/m3u8.c @@ -601,10 +601,11 @@ gst_m3u8_update (GstM3U8Client * client, GstM3U8 * self, gchar * data, } else { self->iframe_lists = g_list_append (self->iframe_lists, new_list); } - } else if (list != NULL) { - GST_WARNING ("Found a list without a uri..., dropping"); - gst_m3u8_free (list); } else { + if (list != NULL) { + GST_WARNING ("Found a list without a uri..., dropping"); + gst_m3u8_free (list); + } list = new_list; } } else if (g_str_has_prefix (data_ext_x, "TARGETDURATION:")) { -- cgit v1.2.1