Commit 61362812fd for ffmpeg
commit 61362812fd2ad9c76a96334c89ff99d1d35f58df
Author: Michael Niedermayer <michael@niedermayer.cc>
Date: Wed Nov 11 18:40:21 2026 +0100
avformat/mpegts: free a PESContext with its filter unless the stream owns it
Fixes: double free
Fixes: fHugfEQx8Ec0
Fixes: ffmpeg-n902-pmt-move-retype-20261027.ts
Double free Replicated through UnModified FFmpeg with ASAN
Found-by: Min Kang
diff --git a/libavformat/mpegts.c b/libavformat/mpegts.c
index c200fb4f45..bffa78a701 100644
--- a/libavformat/mpegts.c
+++ b/libavformat/mpegts.c
@@ -633,7 +633,7 @@ static void mpegts_close_filter(MpegTSContext *ts, MpegTSFilter *filter)
av_buffer_unref(&pes->buffer);
/* referenced private data will be freed later in
* avformat_close_input (pes->st->priv_data == pes) */
- if (!pes->st || pes->merged_st || !pes->st->priv_data) {
+ if (!pes->st || pes->st->priv_data != pes) {
av_freep(&filter->u.pes_filter.opaque);
}
}