diff options
| author | Kacper Michajłow <kasper93@gmail.com> | 2024-03-17 03:36:16 +0100 |
|---|---|---|
| committer | J. Dekker <jdek@itanimul.li> | 2024-05-28 15:02:02 +0200 |
| commit | b2b23f353aa1d4f88bcf00646bf952f0f7f8b033 (patch) | |
| tree | d341f5b25949ffa100d0cf47f454beaf90b2b7ee | |
| parent | 62d7106c36037d1bedd5a2e216540740f8f735eb (diff) | |
| download | ffmpeg-b2b23f353aa1d4f88bcf00646bf952f0f7f8b033.tar.gz | |
avformat/hls: update current segment reference before use
It may be invalidated by the time it is used.
Fixes use after free when accessing current segment.
Fixes: #10825
Signed-off-by: J. Dekker <jdek@itanimul.li>
| -rw-r--r-- | libavformat/hls.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/libavformat/hls.c b/libavformat/hls.c index 214a99c7ba..62473a15dd 100644 --- a/libavformat/hls.c +++ b/libavformat/hls.c @@ -2099,6 +2099,7 @@ static int hls_read_header(AVFormatContext *s) * If encryption scheme is SAMPLE-AES and audio setup information is present in external audio track, * use that information to find the media format, otherwise probe input data */ + seg = current_segment(pls); if (seg && seg->key_type == KEY_SAMPLE_AES && pls->is_id3_timestamped && pls->audio_setup_info.codec_id != AV_CODEC_ID_NONE) { av_assert1(pls->audio_setup_info.codec_id == AV_CODEC_ID_AAC || @@ -2127,6 +2128,7 @@ static int hls_read_header(AVFormatContext *s) av_free(url); } + seg = current_segment(pls); if (seg && seg->key_type == KEY_SAMPLE_AES) { if (strstr(in_fmt->name, "mov")) { char key[33]; @@ -2173,6 +2175,7 @@ static int hls_read_header(AVFormatContext *s) * on us if they want to. */ if (pls->is_id3_timestamped || (pls->n_renditions > 0 && pls->renditions[0]->type == AVMEDIA_TYPE_AUDIO)) { + seg = current_segment(pls); if (seg && seg->key_type == KEY_SAMPLE_AES && pls->audio_setup_info.setup_data_length > 0 && pls->ctx->nb_streams == 1) ret = ff_hls_senc_parse_audio_setup_info(pls->ctx->streams[0], &pls->audio_setup_info); |