[MPlayer-cvslog] r37670 - trunk/stream/stream_dvb.c

[reimar]

Author: reimar
Date: Thu Feb 11 20:43:40 2016
New Revision: 37670

Log:
stream_dvb: Fix memleak and use-after-free.

When realloc succeeds we must overwrite the
old pointer, even if the following malloc fails
and we cannot actually add a new entry.

Modified:
   trunk/stream/stream_dvb.c

Modified: trunk/stream/stream_dvb.c
==============================================================================
--- trunk/stream/stream_dvb.c	Thu Feb 11 20:40:23 2016	(r37669)
+++ trunk/stream/stream_dvb.c	Thu Feb 11 20:43:40 2016	(r37670)
@@ -768,7 +768,6 @@ dvb_config_t *dvb_get_config(void)
 	int i, fd, type, size;
 	char filename[30], *conf_file, *name;
 	dvb_channels_list *list;
-	dvb_card_config_t *cards = NULL, *tmp;
 	dvb_config_t *conf = NULL;
 
 
@@ -781,6 +780,7 @@ dvb_config_t *dvb_get_config(void)
 	conf->cards = NULL;
 	for(i=0; i<MAX_CARDS; i++)
 	{
+		dvb_card_config_t *tmp;
 		snprintf(filename, sizeof(filename), "/dev/dvb/adapter%d/frontend0", i);
 		fd = open(filename, O_RDONLY|O_NONBLOCK);
 		if(fd < 0)
@@ -840,7 +840,7 @@ dvb_config_t *dvb_get_config(void)
 			fprintf(stderr, "DVB_CONFIG, can't realloc %d bytes, skipping\n", size);
 			continue;
 		}
-		cards = tmp;
+		conf->cards = tmp;
 
 		name = malloc(20);
 		if(name==NULL)
@@ -849,7 +849,6 @@ dvb_config_t *dvb_get_config(void)
 			continue;
 		}
 
-		conf->cards = cards;
 		conf->cards[conf->count].devno = i;
 		conf->cards[conf->count].list = list;
 		conf->cards[conf->count].type = type;