[vlc-commits] demux: mpgv: fix potential null deref on missing decoder

[Francois Cartegnie]

vlc | branch: master | Francois Cartegnie <fcvlcdev at free.fr> | Fri Feb 17 11:59:30 2017 +0100| [1a7fbb33134fd308d6aec13be5de627f89bd1c9c] | committer: Francois Cartegnie

demux: mpgv: fix potential null deref on missing decoder

> http://git.videolan.org/gitweb.cgi/vlc.git/?a=commit;h=1a7fbb33134fd308d6aec13be5de627f89bd1c9c
---

 modules/demux/mpeg/mpgv.c | 29 +++++++++++++++++------------
 1 file changed, 17 insertions(+), 12 deletions(-)

diff --git a/modules/demux/mpeg/mpgv.c b/modules/demux/mpeg/mpgv.c
index b6805d8..9773d90 100644
--- a/modules/demux/mpeg/mpgv.c
+++ b/modules/demux/mpeg/mpgv.c
@@ -67,6 +67,18 @@ static int Control( demux_t *, int, va_list );
 #define MPGV_PACKET_SIZE 4096
 
 /*****************************************************************************
+ * Close: frees unused data
+ *****************************************************************************/
+static void Close( vlc_object_t * p_this )
+{
+    demux_t     *p_demux = (demux_t*)p_this;
+    demux_sys_t *p_sys = p_demux->p_sys;
+
+    demux_PacketizerDestroy( p_sys->p_packetizer );
+    free( p_sys );
+}
+
+/*****************************************************************************
  * Open: initializes demux structures
  *****************************************************************************/
 static int Open( vlc_object_t * p_this )
@@ -119,23 +131,16 @@ static int Open( vlc_object_t * p_this )
     /* create the output */
     es_format_Init( &fmt, VIDEO_ES, VLC_CODEC_MPGV );
     p_sys->p_es = es_out_Add( p_demux->out, &fmt );
+    if( p_sys->p_es == NULL )
+    {
+        Close( p_this );
+        return VLC_EGENERIC;
+    }
 
     return VLC_SUCCESS;
 }
 
 /*****************************************************************************
- * Close: frees unused data
- *****************************************************************************/
-static void Close( vlc_object_t * p_this )
-{
-    demux_t     *p_demux = (demux_t*)p_this;
-    demux_sys_t *p_sys = p_demux->p_sys;
-
-    demux_PacketizerDestroy( p_sys->p_packetizer );
-    free( p_sys );
-}
-
-/*****************************************************************************
  * Demux: reads and demuxes data packets
  *****************************************************************************
  * Returns -1 in case of error, 0 in case of EOF, 1 otherwise