From f9db0ea18e2780f43cdb10c6c82b83db77924321 Mon Sep 17 00:00:00 2001 From: =?utf8?q?R=C3=A9mi=20Denis-Courmont?= Date: Wed, 10 Feb 2010 22:40:51 +0200 Subject: [PATCH] fix seg'faulty sout_StreamChainDelete ordering We must delete from the head to the tail, the opposite of the creation order. This stems from the fact that an stream output object "sees" the next element, and may try to use it while being deleted. The crash was easily reproducible with: vlc --sout-keep --sout '#duplicate{dst=gather:std{mux=ts,dst=/dev/null}}' \ -I oldrc -vv raw_es.mp2 --- src/stream_output/stream_output.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/src/stream_output/stream_output.c b/src/stream_output/stream_output.c index b1045d2e46..19b1499540 100644 --- a/src/stream_output/stream_output.c +++ b/src/stream_output/stream_output.c @@ -815,10 +815,11 @@ void sout_StreamChainDelete(sout_stream_t *p_first, sout_stream_t *p_last) if(!p_first) return; - if(p_first != p_last) - sout_StreamChainDelete(p_first->p_next, p_last); + sout_stream_t *p_next = p_first->p_next; sout_StreamDelete(p_first); + if(p_first != p_last) + sout_StreamChainDelete(p_next, p_last); } /* Create a "stream_out" module, which may forward its ES to p_next module */ -- 2.39.5