ogg: fix double free when finding length of small chained oggs.
authorRonald S. Bultje <rsbultje@gmail.com>
Wed, 29 Jun 2011 05:24:21 +0000 (22:24 -0700)
committerCarl Eugen Hoyos <cehoyos@ag.or.at>
Fri, 1 Jul 2011 00:40:47 +0000 (02:40 +0200)
commitb62c0c0bce5c3a203a6e01a4f07d991718c5fac5
treeba60b9f65fc54f996d5afea492bd0a1db2393735
parent00498a7e59727cfe51703d84ac55e055b47c8872
ogg: fix double free when finding length of small chained oggs.

ogg_save() copies streams[], but doesn't keep track of free()'ed
struct members. Thus, if in between a call to ogg_save() and
ogg_restore(), streams[].private was free()'ed, this would result
in a double free -> crash, which happened when e.g. playing small
chained ogg fragments.
(cherry picked from commit 9ed6cbc3ee2ae3e7472fb25192a7e36fd7b15533)
libavformat/oggdec.c