buffer: Fix memory corruption in gst_buffer_foreach_meta() when removing metas

Fix corruption of meta list head when removing metas at the beginning
during iteration. Linked list handling in gst_buffer_foreach_meta
failed to track the previous entry and update the correct next pointer
when removing items from beyond the head of the list, resulting in
arbitrary list pointer corruption.

Closes #332
This commit is contained in:
Dardo D Kleiner 2018-12-01 10:48:11 -05:00 committed by Tim-Philipp Müller
parent 39de78c996
commit 4c87b6ee84

View file

@ -2389,12 +2389,10 @@ gst_buffer_foreach_meta (GstBuffer * buffer, GstBufferForeachMetaFunc func,
/* remove from list */
if (GST_BUFFER_META (buffer) == walk)
GST_BUFFER_META (buffer) = next;
prev = GST_BUFFER_META (buffer) = next;
else
prev->next = next;
prev = next;
/* call free_func if any */
if (info->free_func)
info->free_func (m, buffer);