From 099e716a610af4cf3f745390edd6931585ebea5f Mon Sep 17 00:00:00 2001
From: Tal Shalif <tshalif@nargila.org>
Date: Mon, 3 Nov 2008 11:31:49 +0000
Subject: [PATCH] gst/mpegstream/: Fix memmory corruption due to not storing
 the new updated pointer after a g_renew(). Fixes #558896.

Original commit message from CVS:
Patch by: Tal Shalif <tshalif at nargila dot org>
* gst/mpegstream/gstdvddemux.c:
(gst_dvd_demux_get_subpicture_stream):
* gst/mpegstream/gstmpegdemux.c: (gst_mpeg_demux_get_video_stream),
(gst_mpeg_demux_get_audio_stream):
Fix memmory corruption due to not storing the new updated pointer
after a g_renew(). Fixes #558896.
---
 ChangeLog                     | 11 +++++++++++
 gst/mpegstream/gstdvddemux.c  |  4 ++--
 gst/mpegstream/gstmpegdemux.c | 11 ++++++-----
 3 files changed, 19 insertions(+), 7 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index b5c0ab2af8..624a3e9f11 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,14 @@
+2008-11-03  Wim Taymans  <wim.taymans@collabora.co.uk>
+
+	Patch by: Tal Shalif <tshalif at nargila dot org>
+
+	* gst/mpegstream/gstdvddemux.c:
+	(gst_dvd_demux_get_subpicture_stream):
+	* gst/mpegstream/gstmpegdemux.c: (gst_mpeg_demux_get_video_stream),
+	(gst_mpeg_demux_get_audio_stream):
+	Fix memmory corruption due to not storing the new updated pointer
+	after a g_renew(). Fixes #558896.
+
 2008-10-30  Stefan Kost  <ensonic@users.sf.net>
 
 	* tests/check/Makefile.am:
diff --git a/gst/mpegstream/gstdvddemux.c b/gst/mpegstream/gstdvddemux.c
index f0619a8b3b..0878fbcc17 100644
--- a/gst/mpegstream/gstdvddemux.c
+++ b/gst/mpegstream/gstdvddemux.c
@@ -710,14 +710,14 @@ gst_dvd_demux_get_subpicture_stream (GstMPEGDemux * mpeg_demux,
     str->type = GST_DVD_DEMUX_SUBP_UNKNOWN;
     g_free (name);
     add_pad = TRUE;
-
-    dvd_demux->subpicture_stream[stream_nr] = str;
   } else {
     /* This stream may have been created by a derived class, reset the
        size. */
     str = g_renew (GstMPEGStream, str, 1);
   }
 
+  dvd_demux->subpicture_stream[stream_nr] = str;
+
   if (str->type != GST_DVD_DEMUX_SUBP_DVD) {
     /* We need to set new caps for this pad. */
     str->caps = gst_caps_new_simple ("video/x-dvd-subpicture", NULL);
diff --git a/gst/mpegstream/gstmpegdemux.c b/gst/mpegstream/gstmpegdemux.c
index dbbd02ac05..620d4ca4ed 100644
--- a/gst/mpegstream/gstmpegdemux.c
+++ b/gst/mpegstream/gstmpegdemux.c
@@ -358,16 +358,16 @@ gst_mpeg_demux_get_video_stream (GstMPEGDemux * mpeg_demux,
         CLASS (mpeg_demux)->video_template);
     g_free (name);
 
-    mpeg_demux->video_stream[stream_nr] = str;
-
     set_caps = TRUE;
   } else {
     /* This stream may have been created by a derived class, reset the
        size. */
     video_str = g_renew (GstMPEGVideoStream, str, 1);
-    mpeg_demux->video_stream[stream_nr] = str = (GstMPEGStream *) video_str;
+    str = (GstMPEGStream *) video_str;
   }
 
+  mpeg_demux->video_stream[stream_nr] = str;
+
   if (set_caps || video_str->mpeg_version != mpeg_version) {
     gchar *codec;
     GstTagList *list;
@@ -416,6 +416,7 @@ gst_mpeg_demux_get_audio_stream (GstMPEGDemux * mpeg_demux,
       type < GST_MPEG_DEMUX_AUDIO_LAST, NULL);
 
   str = mpeg_demux->audio_stream[stream_nr];
+
   if (str && str->type != type) {
     gst_element_remove_pad (GST_ELEMENT (mpeg_demux), str->pad);
     g_free (str);
@@ -430,8 +431,6 @@ gst_mpeg_demux_get_audio_stream (GstMPEGDemux * mpeg_demux,
         CLASS (mpeg_demux)->audio_template);
     g_free (name);
 
-    mpeg_demux->audio_stream[stream_nr] = str;
-
     /* new pad, set caps */
     set_caps = TRUE;
   } else {
@@ -440,6 +439,8 @@ gst_mpeg_demux_get_audio_stream (GstMPEGDemux * mpeg_demux,
     str = g_renew (GstMPEGStream, str, 1);
   }
 
+  mpeg_demux->audio_stream[stream_nr] = str;
+
   if (set_caps) {
     GstTagList *list;