[FFmpeg-cvslog] lavf/segment: fix crash when failing to open segment list

[Rodger Combs]

ffmpeg | branch: master | Rodger Combs <rodger.combs at gmail.com> | Fri Jan 20 20:15:03 2017 -0600| [2b202900618d82030384d46c8d9c3dbf3fe1d7ed] | committer: Rodger Combs

lavf/segment: fix crash when failing to open segment list

This happens because segment_end() returns an error, so seg_write_packet
never proceeds to segment_start(), and seg->avf->pb is never re-set,
so we crash with a null pb when av_write_trailer flushes the packet
queue.

This doesn't seem to be clearly recoverable, so I'm just failing more
gracefully.

Repro:
ffmpeg -i input.ts -f segment -c copy -segment_list /noaxx.m3u8 test-%05d.ts

(assuming you don't have write access to /)

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=2b202900618d82030384d46c8d9c3dbf3fe1d7ed
---

 libavformat/segment.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/libavformat/segment.c b/libavformat/segment.c
index 9b3dc17..9d47148 100644
--- a/libavformat/segment.c
+++ b/libavformat/segment.c
@@ -354,6 +354,9 @@ static int segment_end(AVFormatContext *s, int write_trailer, int is_last)
     int i;
     int err;
 
+    if (!oc || !oc->pb)
+        return AVERROR(EINVAL);
+
     av_write_frame(oc, NULL); /* Flush any buffered data (fragmented mp4) */
     if (write_trailer)
         ret = av_write_trailer(oc);
@@ -850,7 +853,7 @@ static int seg_write_packet(AVFormatContext *s, AVPacket *pkt)
     int64_t usecs;
     int64_t wrapped_val;
 
-    if (!seg->avf)
+    if (!seg->avf || !seg->avf->pb)
         return AVERROR(EINVAL);
 
 calc_times: