matroskademux: Ignore unexpected CodecState

Because GstMatroskaTrackContext *stream is set up in the first
SimpleBlock or Block, a rogue CodecState otherwise causes a segfault on
derefencing the NULL pointer. Test case:
bug_s5506167_r0.001____gst_matroska_demux_parse_blockgroup_or_simpleblock.webm

diff --git a/gst/matroska/matroska-demux.c b/gst/matroska/matroska-demux.c
index 3e7280fb2ab9797f9efc992f23a1b575485a2a8f..0e1bbf740f8b8ce36704904c847cb516af3c85b1 100644 (file)
--- a/gst/matroska/matroska-demux.c
+++ b/gst/matroska/matroska-demux.c
@@ -4531,6 +4531,12 @@ gst_matroska_demux_parse_blockgroup_or_simpleblock (GstMatroskaDemux * demux,
                     &data_len)) != GST_FLOW_OK)
           break;
 
+        if (G_UNLIKELY (stream == NULL)) {
+          GST_WARNING_OBJECT (demux,
+              "Unexpected CodecState subelement - ignoring");
+          break;
+        }
+
         g_free (stream->codec_state);
         stream->codec_state = data;
         stream->codec_state_size = data_len;