• Ronald S. Bultje's avatar
    ogg: fix double free when finding length of small chained oggs. · 9ed6cbc3
    Ronald S. Bultje authored
    ogg_save() copies streams[], but doesn't keep track of free()'ed
    struct members. Thus, if in between a call to ogg_save() and
    ogg_restore(), streams[].private was free()'ed, this would result
    in a double free -> crash, which happened when e.g. playing small
    chained ogg fragments.
    9ed6cbc3
oggdec.c 16.5 KB