mirrors/gstreamer
mirrors/gstreamer
1
1
Fork 0
mirror of https://gitlab.freedesktop.org/gstreamer/gstreamer.git synced 2024-11-24 02:31:03 +00:00
Code Issues 1 Projects Releases Wiki Activity

glshader: don't read invalid list pointers (use after free)

Browse source 
gst_gl_shader_detach_unlocked already removes the list entry so attempting to
use the element to iterate to the next stage could read invalid data.

Based on patch by Vineeth TM <vineeth.tm@samsung.com>

https://bugzilla.gnome.org/show_bug.cgi?id=758039
This commit is contained in:
Matthew Waters 2015-11-13 16:50:22 +11:00 committed by Tim-Philipp Müller
parent 0adc7e1bc4
commit 148940c456
1 changed files with 3 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
gst-libs/gst/gl/gstglshader.c
View file

@ -668,10 +668,12 @@ gst_gl_shader_release_unlocked (GstGLShader * shader)
priv = shader->priv; priv = shader->priv;
for (elem = shader->priv->stages; elem; elem = elem->next) { for (elem = shader->priv->stages; elem;) {
GstGLSLStage *stage = elem->data; GstGLSLStage *stage = elem->data;
GList *next = elem->next;
gst_gl_shader_detach_unlocked (shader, stage); gst_gl_shader_detach_unlocked (shader, stage);
elem = next;
} }
g_list_free_full (shader->priv->stages, (GDestroyNotify) gst_object_unref); g_list_free_full (shader->priv->stages, (GDestroyNotify) gst_object_unref);