When the SAP announcement exceeds the transport's max_packet_size, sap_write_header() logged an error and jumped to the fail label without setting ret, which was still 0 from the earlier successful ffurl_open. avformat_write_header() therefore reported success even though sap_write_close() had already torn the muxer down, leading to a NULL dereference in the subsequent sap_write_packet(). Set ret to AVERROR(EINVAL) on this path, matching the other error paths in the function.
Signed-off-by: Anas Khan <[email protected]> --- libavformat/sapenc.c | 1 + 1 file changed, 1 insertion(+) diff --git a/libavformat/sapenc.c b/libavformat/sapenc.c index 87a834a8d8..a39fd16df5 100644 --- a/libavformat/sapenc.c +++ b/libavformat/sapenc.c @@ -241,6 +241,7 @@ static int sap_write_header(AVFormatContext *s) if (sap->ann_size > sap->ann_fd->max_packet_size) { av_log(s, AV_LOG_ERROR, "Announcement too large to send in one " "packet\n"); + ret = AVERROR(EINVAL); goto fail; } -- 2.54.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
