diff options
| author | Rodger Combs <rodger.combs@gmail.com> | 2017-01-20 20:15:03 -0600 |
|---|---|---|
| committer | Rodger Combs <rodger.combs@gmail.com> | 2017-01-23 05:44:49 -0600 |
| commit | 2b202900618d82030384d46c8d9c3dbf3fe1d7ed (patch) | |
| tree | cced22ec20e3df4e86f99f34491b33f53ce30d9c /libavformat/segment.c | |
| parent | e371f031b942d73e02c090170975561fabd5c264 (diff) | |
| download | ffmpeg-2b202900618d82030384d46c8d9c3dbf3fe1d7ed.tar.gz | |
lavf/segment: fix crash when failing to open segment list
This happens because segment_end() returns an error, so seg_write_packet
never proceeds to segment_start(), and seg->avf->pb is never re-set,
so we crash with a null pb when av_write_trailer flushes the packet
queue.
This doesn't seem to be clearly recoverable, so I'm just failing more
gracefully.
Repro:
ffmpeg -i input.ts -f segment -c copy -segment_list /noaxx.m3u8 test-%05d.ts
(assuming you don't have write access to /)
Diffstat (limited to 'libavformat/segment.c')
| -rw-r--r-- | libavformat/segment.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/libavformat/segment.c b/libavformat/segment.c index 9b3dc178eb..9d471483b3 100644 --- a/libavformat/segment.c +++ b/libavformat/segment.c @@ -354,6 +354,9 @@ static int segment_end(AVFormatContext *s, int write_trailer, int is_last) int i; int err; + if (!oc || !oc->pb) + return AVERROR(EINVAL); + av_write_frame(oc, NULL); /* Flush any buffered data (fragmented mp4) */ if (write_trailer) ret = av_write_trailer(oc); @@ -850,7 +853,7 @@ static int seg_write_packet(AVFormatContext *s, AVPacket *pkt) int64_t usecs; int64_t wrapped_val; - if (!seg->avf) + if (!seg->avf || !seg->avf->pb) return AVERROR(EINVAL); calc_times: |