stream_curl: disable by default on libavformat < 62.15.101

DOCS/man/options.rst

@@ -5747,6 +5747,11 @@ TLS/connection diagnostics), set ``--msg-level=curl=trace``.
 ``--curl-enabled=<yes|no>``
     Enable the libcurl-based network backend (default: ``yes``).
 
+    Defaults to ``no`` with libavformat < 62.15.101, which has a nested IO
+    cleanup bug that can cause crashes or memory leaks. The issue happens only
+    on transfer failures or aborts, can be enabled if you don't mind possible
+    stability issues.
+
 ``--curl-http-version=<auto|1.0|1.1|2|2tls|2-prior-knowledge|3|3only>``
     Select the maximum HTTP protocol version libcurl is allowed to negotiate.
     If libcurl was built without HTTP/3 support, it will fallback to ``auto``.

stream/stream_curl.c

@@ -23,6 +23,7 @@
 #include <curl/curl.h>
 
 #include <libavformat/avio.h>
+#include <libavformat/version.h>
 #include <libavutil/avstring.h>
 #include <libavutil/error.h>
 #include <libavutil/mem.h>
@@ -106,7 +107,9 @@ const struct m_sub_options curl_conf = {
         {0}
     },
     .defaults = &(const struct curl_opts) {
-        .enabled = true,
+        // Older lavf has a bug with nested IO cleanup, disable by default.
+        // <https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23082>
+        .enabled = LIBAVFORMAT_VERSION_INT >= AV_VERSION_INT(62, 15, 101),
         .http_version = CURL_HTTP_VERSION_NONE,
         .max_redirects = 16,
         .max_retries = 5,