From 84a807802b1a1c8b7d9b4ac35b73a225e290cd5b Mon Sep 17 00:00:00 2001
From: Martin Storsjo <martin@martin.st>
Date: Thu, 1 Jul 2010 23:06:37 +0300
Subject: [PATCH] url_close_dyn_buf: Don't refer to s->max_packet_size after freeing s

---
 libavformat/aviobuf.c |    7 +++++--
 1 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/libavformat/aviobuf.c b/libavformat/aviobuf.c
index d9eb422..df4ea60 100644
--- a/libavformat/aviobuf.c
+++ b/libavformat/aviobuf.c
@@ -895,10 +895,13 @@ int url_close_dyn_buf(ByteIOContext *s, uint8_t **pbuffer)
     DynBuffer *d = s->opaque;
     int size;
     static const char padbuf[FF_INPUT_BUFFER_PADDING_SIZE] = {0};
+    int padding = 0;
 
     /* don't attempt to pad fixed-size packet buffers */
-    if (!s->max_packet_size)
+    if (!s->max_packet_size) {
         put_buffer(s, padbuf, sizeof(padbuf));
+        padding = FF_INPUT_BUFFER_PADDING_SIZE;
+    }
 
     put_flush_packet(s);
 
@@ -906,6 +909,6 @@ int url_close_dyn_buf(ByteIOContext *s, uint8_t **pbuffer)
     size = d->size;
     av_free(d);
     av_free(s);
-    return size - (s->max_packet_size ? 0 : FF_INPUT_BUFFER_PADDING_SIZE);
+    return size - padding;
 }
 #endif /* CONFIG_MUXERS || CONFIG_NETWORK */
-- 
1.7.1

