[PATCH] libavformat/sapenc: return an error when the announcement is too large

When the SAP announcement exceeds the transport's max_packet_size,
sap_write_header() logged an error and jumped to the fail label without
setting ret, which was still 0 from the earlier successful ffurl_open.
avformat_write_header() therefore reported success even though
sap_write_close() had already torn the muxer down, leading to a NULL
dereference in the subsequent sap_write_packet(). Set ret to
AVERROR(EINVAL) on this path, matching the other error paths in the
function.

Signed-off-by: Anas Khan <[email protected]>
---
 libavformat/sapenc.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/libavformat/sapenc.c b/libavformat/sapenc.c
index 87a834a8d8..a39fd16df5 100644
--- a/libavformat/sapenc.c
+++ b/libavformat/sapenc.c
@@ -241,6 +241,7 @@ static int sap_write_header(AVFormatContext *s)
     if (sap->ann_size > sap->ann_fd->max_packet_size) {
         av_log(s, AV_LOG_ERROR, "Announcement too large to send in one "
                                 "packet\n");
+        ret = AVERROR(EINVAL);
         goto fail;
     }
 
-- 
2.54.0

_______________________________________________
ffmpeg-devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]