sgimb: use after free (fixes #8724)

diff --git a/modules/demux/playlist/sgimb.c b/modules/demux/playlist/sgimb.c
index 5908f9c0429750137f5848094115d8edb58afc01..0bbb55af631d42a2f8ce4180387d1cb4c951e2b4 100644 (file)
--- a/modules/demux/playlist/sgimb.c
+++ b/modules/demux/playlist/sgimb.c
@@ -366,13 +366,12 @@ static int Demux ( demux_t *p_demux )
             return -1;
         }
 
-        free( p_sys->psz_uri );
-        if( asprintf( &p_sys->psz_uri, "%s%%3FMeDiAbAsEshowingId=%d%%26MeDiAbAsEconcert%%3FMeDiAbAsE",
-                p_sys->psz_uri, p_sys->i_sid ) == -1 )
-        {
-            p_sys->psz_uri = NULL;
+        char *uri;
+        if( asprintf( &uri, "%s%%3FMeDiAbAsEshowingId=%d%%26MeDiAbAsEconcert"
+                      "%%3FMeDiAbAsE", p_sys->psz_uri, p_sys->i_sid ) == -1 )
             return -1;
-        }
+        free( p_sys->psz_uri );
+        p_sys->psz_uri = uri;
     }
 
     p_child = input_item_NewWithType( p_sys->psz_uri,