[vlc-commits] demux: ts: fix use after free

[Francois Cartegnie]

vlc | branch: master | Francois Cartegnie <fcvlcdev at free.fr> | Wed Nov  9 20:56:57 2016 +0100| [01423a06e5fc40a09a4eadb313dc2149ad8eaed2] | committer: Francois Cartegnie

demux: ts: fix use after free

regression from 48edcfab53d4dca0e10603a830c20878a8fa84ab,
missing return in refactored code

> http://git.videolan.org/gitweb.cgi/vlc.git/?a=commit;h=01423a06e5fc40a09a4eadb313dc2149ad8eaed2
---

 modules/demux/mpeg/ts.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/modules/demux/mpeg/ts.c b/modules/demux/mpeg/ts.c
index c4944e8..b5c050a 100644
--- a/modules/demux/mpeg/ts.c
+++ b/modules/demux/mpeg/ts.c
@@ -1587,7 +1587,7 @@ static bool PushPESBlock( demux_t *p_demux, ts_pid_t *pid, block_t *p_pkt, bool
         p_pes->gather.p_data = NULL;
         p_pes->gather.i_data_size = 0;
         p_pes->gather.i_gathered = 0;
-        p_pes->gather.pp_last = &pid->u.p_pes->gather.p_data;
+        p_pes->gather.pp_last = &p_pes->gather.p_data;
         ParsePESDataChain( p_demux, pid, p_datachain );
         b_ret = true;
     }
@@ -1599,6 +1599,7 @@ static bool PushPESBlock( demux_t *p_demux, ts_pid_t *pid, block_t *p_pkt, bool
     {
         /* msg_Dbg( p_demux, "broken packet" ); */
         block_Release( p_pkt );
+        return b_ret;
     }
 
     block_ChainLastAppend( &p_pes->gather.pp_last, p_pkt );