stv0g/tvheadend
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

mpegts: fixed segfault caused by an incorrect pointer access when flushing subscriptions.

Browse source 
See http://pastebin.com/GnwRJVhK for stack trace.
This commit is contained in:
John Törblom 2013-07-09 09:36:19 +02:00
parent 4e1c8e916c
commit a40f1ffc40
1 changed files with 4 additions and 6 deletions

8
src/input/mpegts/mpegts_input.c
View file

@ -187,7 +187,7 @@ mpegts_input_stopped_mux
( mpegts_input_t *mi, mpegts_mux_instance_t *mmi ) ( mpegts_input_t *mi, mpegts_mux_instance_t *mmi )
{ {
char buf[256]; char buf[256];
service_t *s, *t; service_t *s;
mmi->mmi_mux->mm_active = NULL; mmi->mmi_mux->mm_active = NULL;
LIST_REMOVE(mmi, mmi_active_link); LIST_REMOVE(mmi, mmi_active_link);
@ -195,11 +195,9 @@ mpegts_input_stopped_mux
tvhtrace("mpegts", "%s - flush subscribers", buf); tvhtrace("mpegts", "%s - flush subscribers", buf);
s = LIST_FIRST(&mi->mi_transports); s = LIST_FIRST(&mi->mi_transports);
while (s) { while (s) {
t = s; if (((mpegts_service_t*)s)->s_dvb_mux == mmi->mmi_mux)
s = LIST_NEXT(t, s_active_link);
if (((mpegts_service_t*)s)->s_dvb_mux != mmi->mmi_mux)
continue;
service_remove_subscriber(s, NULL, SM_CODE_SUBSCRIPTION_OVERRIDDEN); service_remove_subscriber(s, NULL, SM_CODE_SUBSCRIPTION_OVERRIDDEN);
s = LIST_NEXT(s, s_active_link);
} }
} }