fix seg'faulty sout_StreamChainDelete ordering

We must delete from the head to the tail, the opposite of the creation
order. This stems from the fact that an stream output object "sees" the
next element, and may try to use it while being deleted.

The crash was easily reproducible with:
vlc --sout-keep --sout '#duplicate{dst=gather:std{mux=ts,dst=/dev/null}}' \
    -I oldrc -vv raw_es.mp2

diff --git a/src/stream_output/stream_output.c b/src/stream_output/stream_output.c
index b1045d2e463f10ad793ee5f73c8c287b9e6c03f7..19b1499540cc66b27a19d9c57fb133505552917d 100644 (file)
--- a/src/stream_output/stream_output.c
+++ b/src/stream_output/stream_output.c
@@ -815,10 +815,11 @@ void sout_StreamChainDelete(sout_stream_t *p_first, sout_stream_t *p_last)
     if(!p_first)
         return;
 
-    if(p_first != p_last)
-        sout_StreamChainDelete(p_first->p_next, p_last);
+    sout_stream_t *p_next = p_first->p_next;
 
     sout_StreamDelete(p_first);
+    if(p_first != p_last)
+        sout_StreamChainDelete(p_next, p_last);
 }
 
 /* Create a "stream_out" module, which may forward its ES to p_next module */