[mythtv-commits] Ticket #3074: AvFormatDecoder and avformat double free crashes

[MythTV]

#3074: AvFormatDecoder and avformat double free crashes
-----------------------+----------------------------------------------------
 Reporter:  jwestfall  |       Owner:  ijr    
     Type:  defect     |      Status:  new    
 Priority:  minor      |   Milestone:  unknown
Component:  mythtv     |     Version:  head   
 Severity:  medium     |  
-----------------------+----------------------------------------------------
 Been getting this crash quite often.  During tear down of AvFormatDecoder
 there appears to be a double free of ic->pb.buffer;

 AvFormatDecoder::CloseContext() does a av_free(ic->pb.buffer) then calls
 av_close_input_file(ic), which will end up freeing pb.buffer again in
 url_fclose(&s->pb).  The latter av_free will only trigger under the
 following condition

 {{{
 void av_close_input_file(AVFormatContext *s)
 {
 ...
     must_open_file = 1;
     if (s->iformat->flags & AVFMT_NOFILE) {
         must_open_file = 0;
     }
     if (must_open_file) {
         url_fclose(&s->pb);
     }

 }}}

-- 
Ticket URL: <http://svn.mythtv.org/trac/ticket/3074>
MythTV <http://www.mythtv.org/>
MythTV