mov: prevent double free if the caller replaces the io context.
Fixes Ticket2148 Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
parent
b3ab281027
commit
0a84174f2d
@ -94,6 +94,7 @@ typedef struct MOVSbgp {
|
|||||||
|
|
||||||
typedef struct MOVStreamContext {
|
typedef struct MOVStreamContext {
|
||||||
AVIOContext *pb;
|
AVIOContext *pb;
|
||||||
|
int pb_is_copied;
|
||||||
int ffindex; ///< AVStream index
|
int ffindex; ///< AVStream index
|
||||||
int next_chunk;
|
int next_chunk;
|
||||||
unsigned int chunk_count;
|
unsigned int chunk_count;
|
||||||
|
@ -2230,8 +2230,10 @@ static int mov_read_trak(MOVContext *c, AVIOContext *pb, MOVAtom atom)
|
|||||||
"filename='%s', volume='%s', nlvl_from=%d, nlvl_to=%d\n",
|
"filename='%s', volume='%s', nlvl_from=%d, nlvl_to=%d\n",
|
||||||
st->index, dref->path, dref->dir, dref->filename,
|
st->index, dref->path, dref->dir, dref->filename,
|
||||||
dref->volume, dref->nlvl_from, dref->nlvl_to);
|
dref->volume, dref->nlvl_from, dref->nlvl_to);
|
||||||
} else
|
} else {
|
||||||
sc->pb = c->fc->pb;
|
sc->pb = c->fc->pb;
|
||||||
|
sc->pb_is_copied = 1;
|
||||||
|
}
|
||||||
|
|
||||||
if (st->codec->codec_type == AVMEDIA_TYPE_VIDEO) {
|
if (st->codec->codec_type == AVMEDIA_TYPE_VIDEO) {
|
||||||
if (!st->sample_aspect_ratio.num &&
|
if (!st->sample_aspect_ratio.num &&
|
||||||
@ -3071,7 +3073,7 @@ static int mov_read_close(AVFormatContext *s)
|
|||||||
av_freep(&sc->drefs[j].dir);
|
av_freep(&sc->drefs[j].dir);
|
||||||
}
|
}
|
||||||
av_freep(&sc->drefs);
|
av_freep(&sc->drefs);
|
||||||
if (sc->pb && sc->pb != s->pb)
|
if (!sc->pb_is_copied)
|
||||||
avio_close(sc->pb);
|
avio_close(sc->pb);
|
||||||
sc->pb = NULL;
|
sc->pb = NULL;
|
||||||
av_freep(&sc->chunk_offsets);
|
av_freep(&sc->chunk_offsets);
|
||||||
|
Loading…
x
Reference in New Issue
Block a user