From e0b4290998d9a95553b7b6ad732891e3d1c8cc5b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Andr=C3=A9=20Draszik?= Date: Tue, 20 Oct 2015 09:13:04 +0100 Subject: [PATCH] hlsdemux: don't crash or leak memory on broken master playlist If a (master) playlist contains a variant list entry without a URI then during parsing of the next variant list entry we are a) leaking the entry we're currently parsing (new_list), and b) free'ing the pointer to the previous list entry (list) without updating the pointer. Hence when then adding the URI for the latest parsed entry, incorrect information is stored, as the information is used from 'list' which is not valid memory anymore, also leading to crashes. Fix this by correctly storing the new variant list entry pointer as needed. https://bugzilla.gnome.org/show_bug.cgi?id=756861 --- ext/hls/m3u8.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/ext/hls/m3u8.c b/ext/hls/m3u8.c index 18829f16c1..7164ae2e9e 100644 --- a/ext/hls/m3u8.c +++ b/ext/hls/m3u8.c @@ -583,10 +583,11 @@ gst_m3u8_update (GstM3U8Client * client, GstM3U8 * self, gchar * data, } else { self->iframe_lists = g_list_append (self->iframe_lists, new_list); } - } else if (list != NULL) { - GST_WARNING ("Found a list without a uri..., dropping"); - gst_m3u8_free (list); } else { + if (list != NULL) { + GST_WARNING ("Found a list without a uri..., dropping"); + gst_m3u8_free (list); + } list = new_list; } } else if (g_str_has_prefix (data_ext_x, "TARGETDURATION:")) {