Ronald S. Bultje 9ed6cbc3ee ogg: fix double free when finding length of small chained oggs. ...

ogg_save() copies streams[], but doesn't keep track of free()'ed
struct members. Thus, if in between a call to ogg_save() and
ogg_restore(), streams[].private was free()'ed, this would result
in a double free -> crash, which happened when e.g. playing small
chained ogg fragments.

2011-06-29 09:45:52 -07:00

16 KiB

Raw Blame History

View Raw