vulkandisplay: fix use-after-free with removal of window

g_list_delete_link() free()'s the list node so any access after that is
a use-after-free.
This commit is contained in:
Matthew Waters 2019-08-22 14:55:40 +10:00
parent e83df1759d
commit fc9f047885

View file

@ -363,9 +363,10 @@ gst_vulkan_display_remove_window (GstVulkanDisplay * display,
GST_OBJECT_LOCK (display); GST_OBJECT_LOCK (display);
l = _find_window_list_item (display, window); l = _find_window_list_item (display, window);
if (l) { if (l) {
GWeakRef *ref = l->data;
display->windows = g_list_delete_link (display->windows, l); display->windows = g_list_delete_link (display->windows, l);
g_weak_ref_clear (l->data); g_weak_ref_clear (ref);
g_free (l->data); g_free (ref);
ret = TRUE; ret = TRUE;
} }
GST_OBJECT_UNLOCK (display); GST_OBJECT_UNLOCK (display);