From dcfea9c35a8f4ee08013619c90fca8599bc10a45 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
Date: Thu, 22 Dec 2022 21:12:35 +0200
Subject: [PATCH] gl: Reset video frame size/stride/offset to 0 for GL mapped
 frames

The memory pointers are actually the GL texture IDs, and accessing them
like raw video memory will read random memory areas.

Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer-rs/-/merge_requests/1173>
---
 gstreamer-gl/Cargo.toml            |  1 -
 gstreamer-gl/src/gl_video_frame.rs | 29 ++++++++++++++++++++---------
 2 files changed, 20 insertions(+), 10 deletions(-)

diff --git a/gstreamer-gl/Cargo.toml b/gstreamer-gl/Cargo.toml
index 66dc862b3..5dce031da 100644
--- a/gstreamer-gl/Cargo.toml
+++ b/gstreamer-gl/Cargo.toml
@@ -18,7 +18,6 @@ rust-version = "1.63"
 
 [dependencies]
 bitflags = "1.0"
-byteorder = "1"
 libc = "0.2"
 once_cell = "1.0"
 ffi = { package = "gstreamer-gl-sys", path = "sys" }
diff --git a/gstreamer-gl/src/gl_video_frame.rs b/gstreamer-gl/src/gl_video_frame.rs
index badfcb160..c30ba5852 100644
--- a/gstreamer-gl/src/gl_video_frame.rs
+++ b/gstreamer-gl/src/gl_video_frame.rs
@@ -3,7 +3,6 @@
 use glib::translate::{from_glib, ToGlibPtr};
 use gst_video::video_frame::Readable;
 
-use byteorder::{NativeEndian, ReadBytesExt};
 use std::mem;
 
 pub trait VideoFrameGLExt {
@@ -76,7 +75,14 @@ impl<'a> VideoFrameGLExt for gst_video::VideoFrameRef<&'a gst::BufferRef> {
             if !res {
                 Err(buffer)
             } else {
-                Ok(gst_video::VideoFrame::from_glib_full(frame.assume_init()))
+                let mut frame = frame.assume_init();
+                // Reset size/stride/offset to 0 as the memory pointers
+                // are the GL texture ID and accessing them would read
+                // random memory.
+                frame.info.size = 0;
+                frame.info.stride.fill(0);
+                frame.info.offset.fill(0);
+                Ok(gst_video::VideoFrame::from_glib_full(frame))
             }
         }
     }
@@ -117,9 +123,14 @@ impl<'a> VideoFrameGLExt for gst_video::VideoFrameRef<&'a gst::BufferRef> {
                     "Failed to fill in the values of GstVideoFrame"
                 ))
             } else {
-                Ok(gst_video::VideoFrameRef::from_glib_full(
-                    frame.assume_init(),
-                ))
+                let mut frame = frame.assume_init();
+                // Reset size/stride/offset to 0 as the memory pointers
+                // are the GL texture ID and accessing them would read
+                // random memory.
+                frame.info.size = 0;
+                frame.info.stride.fill(0);
+                frame.info.offset.fill(0);
+                Ok(gst_video::VideoFrameRef::from_glib_full(frame))
             }
         }
     }
@@ -136,10 +147,10 @@ impl<'a> VideoFrameGLExt for gst_video::VideoFrameRef<&'a gst::BufferRef> {
             return None;
         }
 
-        let mut data = self.plane_data(idx).ok()?;
-        let id = &data.read_u32::<NativeEndian>().ok()?;
-
-        Some(*id)
+        unsafe {
+            let ptr = (*self.as_ptr()).data[idx as usize] as *const u32;
+            Some(*ptr)
+        }
     }
 }