From a40f1ffc40a826024042c9b89a3b50ac44da7579 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?John=20T=C3=B6rblom?= Date: Tue, 9 Jul 2013 09:36:19 +0200 Subject: [PATCH] mpegts: fixed segfault caused by an incorrect pointer access when flushing subscriptions. See http://pastebin.com/GnwRJVhK for stack trace. --- src/input/mpegts/mpegts_input.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/src/input/mpegts/mpegts_input.c b/src/input/mpegts/mpegts_input.c index 31d20617..8463a972 100644 --- a/src/input/mpegts/mpegts_input.c +++ b/src/input/mpegts/mpegts_input.c @@ -187,7 +187,7 @@ mpegts_input_stopped_mux ( mpegts_input_t *mi, mpegts_mux_instance_t *mmi ) { char buf[256]; - service_t *s, *t; + service_t *s; mmi->mmi_mux->mm_active = NULL; LIST_REMOVE(mmi, mmi_active_link); @@ -195,11 +195,9 @@ mpegts_input_stopped_mux tvhtrace("mpegts", "%s - flush subscribers", buf); s = LIST_FIRST(&mi->mi_transports); while (s) { - t = s; - s = LIST_NEXT(t, s_active_link); - if (((mpegts_service_t*)s)->s_dvb_mux != mmi->mmi_mux) - continue; - service_remove_subscriber(s, NULL, SM_CODE_SUBSCRIPTION_OVERRIDDEN); + if (((mpegts_service_t*)s)->s_dvb_mux == mmi->mmi_mux) + service_remove_subscriber(s, NULL, SM_CODE_SUBSCRIPTION_OVERRIDDEN); + s = LIST_NEXT(s, s_active_link); } }