mirrors/gstreamer
mirrors/gstreamer
1
1
Fork 0
mirror of https://gitlab.freedesktop.org/gstreamer/gstreamer.git synced 2024-11-24 02:31:03 +00:00
Code Issues 1 Projects Releases Wiki Activity

fdkaacenc: fix accessing freed memory

Browse source 
The buffer data is not always copied in _Fill, and will be
read in _DecodeFrame. We unmap at the end of the function,
whether we get there via failure or early out, and keep a
ref to the buffer to ensure we can use it to unmap the
memory even after _finish_frame is called, as it unrefs
the buffer.

Note that there is an access beyond the allocated buffer,
which is only apparent when playing from souphttpsrc (ie,
not from filesrc). This appears to be a bug in the bit
reading code in libfdkaac AFAICT.

https://bugzilla.gnome.org/show_bug.cgi?id=772186
This commit is contained in:
Vincent Penquerc'h 2016-09-29 14:32:15 +01:00
parent 58bb21c463
commit ce59031b10
1 changed files with 6 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
ext/fdkaac/gstfdkaacdec.c
View file

@ -190,6 +190,7 @@ gst_fdkaacdec_handle_frame (GstAudioDecoder * dec, GstBuffer * inbuf)
gboolean need_reorder; gboolean need_reorder;
if (inbuf) { if (inbuf) {
gst_buffer_ref (inbuf);
gst_buffer_map (inbuf, &imap, GST_MAP_READ); gst_buffer_map (inbuf, &imap, GST_MAP_READ);
valid = size = imap.size; valid = size = imap.size;
@ -198,10 +199,8 @@ gst_fdkaacdec_handle_frame (GstAudioDecoder * dec, GstBuffer * inbuf)
&valid)) != AAC_DEC_OK) { &valid)) != AAC_DEC_OK) {
GST_AUDIO_DECODER_ERROR (self, 1, STREAM, DECODE, (NULL), GST_AUDIO_DECODER_ERROR (self, 1, STREAM, DECODE, (NULL),
("filling error: %d", err), ret); ("filling error: %d", err), ret);
gst_buffer_unmap (inbuf, &imap);
goto out; goto out;
} }
gst_buffer_unmap (inbuf, &imap);
if (GST_BUFFER_IS_DISCONT (inbuf)) if (GST_BUFFER_IS_DISCONT (inbuf))
flags |= AACDEC_INTR; flags |= AACDEC_INTR;
@ -395,6 +394,11 @@ finish:
out: out:
if (inbuf) {
gst_buffer_unmap (inbuf, &imap);
gst_buffer_unref (inbuf);
}
return ret; return ret;
} }