GNOME Bugzilla – Bug 752496
dashdemux: illegal memory access when the list of S nodes is greater than the list of SegmentURL nodes
Last modified: 2015-10-29 11:05:25 UTC
When building the media segment list using a SegmentList node, the gst_mpd_client_setup_representation function will iterate through the list of S nodes and for each S node will expect to find a matching SegmentUrl node. If one does not exist, the code makes an illegal memory access when it tries to access a NULL SegmentURL pointer.
Created attachment 307567 [details] [review] proposed fix and unit tests
Looks correct. It also concerns me about the handling of the repeated S entries and matching those to the SegmentURLs as well. Looks like the same URL will be used for all the repetitions of an S node. I wonder what the spec has to say about it.
the spec is not very clear. I expected the repetitions to target different SergmentURLs, (eg a segment timeline with r=2 should have 3 segment URLs, because segment timeline is just a compressed form to avoid specifying the same duration for each segment) but it seems the implementation is different and just repeats the same segment URL over and over. Personally I think the implementation is wrong, but I don't have any examples to prove it.
commit 566e84cec1b372069b00b3594d1fa592ddd0c12c Author: Florin Apostol <florin.apostol@oregan.net> Date: Wed Oct 28 17:02:51 2015 +0000 dashdemux: fixed crash when segment timeline list is greater than segment url list When building the media segment list using a SegmentList node, the gst_mpd_client_setup_representation function will iterate through the list of S nodes and will expect to find a matching SegmentUrl node. If one does not exist, the code made an illegal memory access. https://bugzilla.gnome.org/show_bug.cgi?id=752496