mirrors/gstreamer
mirrors/gstreamer
1
1
Fork 0
mirror of https://gitlab.freedesktop.org/gstreamer/gstreamer.git synced 2024-11-29 05:01:23 +00:00
Code Issues 1 Projects Releases Wiki Activity

bin: Fix use-after-free issue in gst_bin_add()

Browse source 
gst_element_post_message() takes ownership of the message so we need to increase
its refcount until we no longer require access to its data (context_type).

https://bugzilla.gnome.org/show_bug.cgi?id=797099
This commit is contained in:
Philippe Normand 2018-09-08 13:05:13 +01:00 committed by Tim-Philipp Müller
parent cbd02b9584
commit 616d588b52
1 changed files with 3 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
gst/gstbin.c
View file

@ -1301,12 +1301,14 @@ no_state_recalc:
s = (GstStructure *) gst_message_get_structure (msg); s = (GstStructure *) gst_message_get_structure (msg);
gst_structure_get (s, "bin.old.context", GST_TYPE_CONTEXT, &context, NULL); gst_structure_get (s, "bin.old.context", GST_TYPE_CONTEXT, &context, NULL);
gst_structure_remove_field (s, "bin.old.context"); gst_structure_remove_field (s, "bin.old.context");
gst_element_post_message (GST_ELEMENT_CAST (bin), msg); /* Keep the msg around while we still need access to the context_type */
gst_element_post_message (GST_ELEMENT_CAST (bin), gst_message_ref (msg));
/* lock to avoid losing a potential write */ /* lock to avoid losing a potential write */
GST_OBJECT_LOCK (bin); GST_OBJECT_LOCK (bin);
replacement = replacement =
gst_element_get_context_unlocked (GST_ELEMENT_CAST (bin), context_type); gst_element_get_context_unlocked (GST_ELEMENT_CAST (bin), context_type);
gst_message_unref (msg);
if (replacement) { if (replacement) {
/* we got the context set from GstElement::set_context */ /* we got the context set from GstElement::set_context */