GNOME Bugzilla – Bug 774287
hls: gst_m3u8_has_next_fragment crash
Last modified: 2016-11-12 08:39:42 UTC
Function 'gst_m3u8_has_next_fragment' in 'gst-plugins-bad-1.9.90\ext\hls\m3u8.c' periodically crashes the program when cur=NULL .text:6B40225F mov edi, [cur+4] gboolean gst_m3u8_has_next_fragment (GstM3U8 * m3u8, gboolean forward) { ... cur = m3u8_find_next_fragment (m3u8, forward); <-- Can return NULL ... have_next = (forward && cur->next) || (!forward && cur->prev); <-- CRASH! ... } The value 'cur' must be checked for NULL and so expression for 'have_next' will look like: have_next = cur && ((forward && cur->next) || (!forward && cur->prev));
commit 31892110bc3dcb04ef9824ca708d1e699bd0869e Author: Sebastian Dröge <sebastian@centricular.com> Date: Sat Nov 12 10:38:04 2016 +0200 hlsdemux: Fix NULL pointer dereference when checking if there is a next fragment Thanks to Aleksandr <tumaleksandr@yandex.ua> for reporting and suggesting the fix. https://bugzilla.gnome.org/show_bug.cgi?id=774287