hlsdemux: don't crash or leak memory on broken master playlist

If a (master) playlist contains a variant list entry without a
URI then during parsing of the next variant list entry we are
a) leaking the entry we're currently parsing (new_list), and
b) free'ing the pointer to the previous list entry (list) without
   updating the pointer.

Hence when then adding the URI for the latest parsed entry, incorrect
information is stored, as the information is used from 'list' which
is not valid memory anymore, also leading to crashes.

Fix this by correctly storing the new variant list entry pointer
as needed.

https://bugzilla.gnome.org/show_bug.cgi?id=756861

diff --git a/ext/hls/m3u8.c b/ext/hls/m3u8.c
index 18829f1..7164ae2 100644 (file)
--- a/ext/hls/m3u8.c
+++ b/ext/hls/m3u8.c
@@ -583,10 +583,11 @@ gst_m3u8_update (GstM3U8Client * client, GstM3U8 * self, gchar * data,
           } else {
             self->iframe_lists = g_list_append (self->iframe_lists, new_list);
           }
-        } else if (list != NULL) {
-          GST_WARNING ("Found a list without a uri..., dropping");
-          gst_m3u8_free (list);
         } else {
+          if (list != NULL) {
+            GST_WARNING ("Found a list without a uri..., dropping");
+            gst_m3u8_free (list);
+          }
           list = new_list;
         }
       } else if (g_str_has_prefix (data_ext_x, "TARGETDURATION:")) {