[vlc-commits] mkv: Fix potential invalid ES deletion

[Hugo Beauzée-Luyssen]

vlc | branch: master | Hugo Beauzée-Luyssen <hugo at beauzee.fr> | Tue Mar  5 17:20:49 2019 +0100| [08587dfd0d35eebf9a4ac1509c746307c5cff8e4] | committer: Hugo Beauzée-Luyssen

mkv: Fix potential invalid ES deletion

https://hackerone.com/reports/502816

> http://git.videolan.org/gitweb.cgi/vlc.git/?a=commit;h=08587dfd0d35eebf9a4ac1509c746307c5cff8e4
---

 modules/demux/mkv/events.cpp           | 5 +++--
 modules/demux/mkv/events.hpp           | 2 +-
 modules/demux/mkv/matroska_segment.cpp | 8 +++++++-
 3 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/modules/demux/mkv/events.cpp b/modules/demux/mkv/events.cpp
index 66d7855cc3..12f6c430e6 100644
--- a/modules/demux/mkv/events.cpp
+++ b/modules/demux/mkv/events.cpp
@@ -334,7 +334,7 @@ void event_thread_t::HandleMouseEvent( EventInfo const& event )
     }
 }
 
-void event_thread_t::AddES( es_out_id_t* es, int category )
+bool event_thread_t::AddES( es_out_id_t* es, int category )
 {
     vlc_mutex_locker lock_guard( &lock );
 
@@ -348,9 +348,10 @@ void event_thread_t::AddES( es_out_id_t* es, int category )
         {
             msg_Warn( p_demux, "Unable to subscribe to mouse events" );
             es_list.erase( info );
-            return;
+            return false;
         }
     }
+    return true;
 }
 
 void event_thread_t::DelES( es_out_id_t* es )
diff --git a/modules/demux/mkv/events.hpp b/modules/demux/mkv/events.hpp
index 1328feb7fa..f6c12ef651 100644
--- a/modules/demux/mkv/events.hpp
+++ b/modules/demux/mkv/events.hpp
@@ -46,7 +46,7 @@ public:
     void SetPci(const pci_t *data);
     void ResetPci();
 
-    void AddES( es_out_id_t* es, int category );
+    bool AddES( es_out_id_t* es, int category );
     void DelES( es_out_id_t* es );
 
 private:
diff --git a/modules/demux/mkv/matroska_segment.cpp b/modules/demux/mkv/matroska_segment.cpp
index 9aed37b59a..43247cae46 100644
--- a/modules/demux/mkv/matroska_segment.cpp
+++ b/modules/demux/mkv/matroska_segment.cpp
@@ -1124,7 +1124,13 @@ bool matroska_segment_c::ESCreate()
             track.p_es = es_out_Add( sys.demuxer.out, &track.fmt );
 
             if( track.p_es )
-                sys.ev.AddES( track.p_es, track.fmt.i_cat );
+            {
+                if (!sys.ev.AddES( track.p_es, track.fmt.i_cat ))
+                {
+                    es_out_Del( sys.demuxer.out, track.p_es );
+                    track.p_es = NULL;
+                }
+            }
         }
 
         /* Turn on a subtitles track if it has been flagged as default -