[vlc-commits] avformat demux: fix invalid free

[Rafaël Carré]

vlc | branch: master | Rafaël Carré <funman at videolan.org> | Sat Nov  3 00:17:32 2012 +0100| [d78306636bb368e88a73aa0a1ec6306b67beb771] | committer: Rafaël Carré

avformat demux: fix invalid free

the number of streams can change after we find the stream info

> http://git.videolan.org/gitweb.cgi/vlc.git/?a=commit;h=d78306636bb368e88a73aa0a1ec6306b67beb771
---

 modules/demux/avformat/demux.c |    8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/modules/demux/avformat/demux.c b/modules/demux/avformat/demux.c
index 74447ed..7ca9769 100644
--- a/modules/demux/avformat/demux.c
+++ b/modules/demux/avformat/demux.c
@@ -238,24 +238,26 @@ int OpenDemux( vlc_object_t *p_this )
     char *psz_opts = var_InheritString( p_demux, "avformat-options" );
     AVDictionary *options[p_sys->ic->nb_streams ? p_sys->ic->nb_streams : 1];
     options[0] = NULL;
-    for (unsigned i = 1; i < p_sys->ic->nb_streams; i++)
+    unsigned int nb_streams = p_sys->ic->nb_streams;
+    for (unsigned i = 1; i < nb_streams; i++)
         options[i] = NULL;
     if (psz_opts && *psz_opts) {
         options[0] = vlc_av_get_options(psz_opts);
-        for (unsigned i = 1; i < p_sys->ic->nb_streams; i++) {
+        for (unsigned i = 1; i < nb_streams; i++) {
             av_dict_copy(&options[i], options[0], 0);
         }
     }
     free(psz_opts);
     vlc_avcodec_lock(); /* avformat calls avcodec behind our back!!! */
     error = avformat_find_stream_info( p_sys->ic, options );
+    /* FIXME: what if nb_streams change after that call? */
     vlc_avcodec_unlock();
     AVDictionaryEntry *t = NULL;
     while ((t = av_dict_get(options[0], "", t, AV_DICT_IGNORE_SUFFIX))) {
         msg_Err( p_demux, "Unknown option \"%s\"", t->key );
     }
     av_dict_free(&options[0]);
-    for (unsigned i = 1; i < p_sys->ic->nb_streams; i++) {
+    for (unsigned i = 1; i < nb_streams; i++) {
         av_dict_free(&options[i]);
     }
 #else