mirrors/gstreamer
mirrors/gstreamer
1
1
Fork 0
mirror of https://gitlab.freedesktop.org/gstreamer/gstreamer.git synced 2024-11-25 19:21:06 +00:00
Code Issues 1 Projects Releases Wiki Activity

webrtc: Fix segfault traversing ice transports

Browse source 
Previously, reassigning loop index l in nicestream.c
could cause a segfault if l->data was null, as it could
reassign l to a null variable, triggering the loop
postassignment l->next, which then segfaults due to
l now being null. It is instead moved into the loop.
_delete_transport already performs the reassignment
inline.

Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/4192>
This commit is contained in:
Albert Sjölund 2023-03-16 13:33:46 +01:00 committed by GStreamer Marge Bot
parent d6dd81dbdd
commit d3f92b9760
1 changed files with 8 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
subprojects/gst-plugins-bad/gst-libs/gst/webrtc/nice/nicestream.c
View file

@ -149,13 +149,14 @@ _on_candidate_gathering_done (NiceAgent * agent, guint stream_id,
ice->priv->gathered = TRUE; ice->priv->gathered = TRUE;
for (l = ice->priv->transports; l; l = l->next) { for (l = ice->priv->transports; l;) {
GstWebRTCICETransport *trans = g_weak_ref_get (l->data); GstWebRTCICETransport *trans = g_weak_ref_get (l->data);
if (trans) { if (trans) {
gst_webrtc_ice_transport_gathering_state_change (trans, gst_webrtc_ice_transport_gathering_state_change (trans,
GST_WEBRTC_ICE_GATHERING_STATE_COMPLETE); GST_WEBRTC_ICE_GATHERING_STATE_COMPLETE);
g_object_unref (trans); g_object_unref (trans);
l = l->next;
} else { } else {
l = _delete_transport (&ice->priv->transports, l); l = _delete_transport (&ice->priv->transports, l);
} }
@ -174,7 +175,7 @@ gst_webrtc_nice_stream_find_transport (GstWebRTCICEStream * stream,
GList *l; GList *l;
GstWebRTCNiceStream *nice_stream = GST_WEBRTC_NICE_STREAM (stream); GstWebRTCNiceStream *nice_stream = GST_WEBRTC_NICE_STREAM (stream);
for (l = nice_stream->priv->transports; l; l = l->next) { for (l = nice_stream->priv->transports; l;) {
GstWebRTCICETransport *trans = g_weak_ref_get (l->data); GstWebRTCICETransport *trans = g_weak_ref_get (l->data);
if (trans) { if (trans) {
g_object_get (trans, "component", &trans_comp, NULL); g_object_get (trans, "component", &trans_comp, NULL);
@ -183,6 +184,7 @@ gst_webrtc_nice_stream_find_transport (GstWebRTCICEStream * stream,
return trans; return trans;
else else
gst_object_unref (trans); gst_object_unref (trans);
l = l->next;
} else { } else {
l = _delete_transport (&nice_stream->priv->transports, l); l = _delete_transport (&nice_stream->priv->transports, l);
} }
@ -234,13 +236,14 @@ gst_webrtc_nice_stream_gather_candidates (GstWebRTCICEStream * stream)
if (nice_stream->priv->gathered) if (nice_stream->priv->gathered)
return TRUE; return TRUE;
for (l = nice_stream->priv->transports; l; l = l->next) { for (l = nice_stream->priv->transports; l;) {
GstWebRTCICETransport *trans = g_weak_ref_get (l->data); GstWebRTCICETransport *trans = g_weak_ref_get (l->data);
if (trans) { if (trans) {
gst_webrtc_ice_transport_gathering_state_change (trans, gst_webrtc_ice_transport_gathering_state_change (trans,
GST_WEBRTC_ICE_GATHERING_STATE_GATHERING); GST_WEBRTC_ICE_GATHERING_STATE_GATHERING);
g_object_unref (trans); g_object_unref (trans);
l = l->next;
} else { } else {
l = _delete_transport (&nice_stream->priv->transports, l); l = _delete_transport (&nice_stream->priv->transports, l);
} }
@ -273,12 +276,13 @@ gst_webrtc_nice_stream_gather_candidates (GstWebRTCICEStream * stream)
goto cleanup; goto cleanup;
} }
for (l = nice_stream->priv->transports; l; l = l->next) { for (l = nice_stream->priv->transports; l;) {
GstWebRTCNiceTransport *trans = g_weak_ref_get (l->data); GstWebRTCNiceTransport *trans = g_weak_ref_get (l->data);
if (trans) { if (trans) {
gst_webrtc_nice_transport_update_buffer_size (trans); gst_webrtc_nice_transport_update_buffer_size (trans);
g_object_unref (trans); g_object_unref (trans);
l = l->next;
} else { } else {
l = _delete_transport (&nice_stream->priv->transports, l); l = _delete_transport (&nice_stream->priv->transports, l);
} }