diff options
| author | Guillaume Desmottes <guillaume.desmottes@collabora.com> | 2019-04-16 14:35:06 +0530 |
|---|---|---|
| committer | Tim-Philipp Müller <tim@centricular.com> | 2019-05-06 23:43:07 +0200 |
| commit | dc08cece5e221f0b0e3c319221a121d88cb1426b (patch) | |
| tree | c9fe08a0a0afa3e363ad35440f9589a815abb745 | |
| parent | 438aebfa2312dea22666407e1c2714ae17507a59 (diff) | |
v4l2: fix use after free when handling events
The sink_event parent function may consume the event so we shouldn't use
it after having calling it.
| -rw-r--r-- | sys/v4l2/gstv4l2transform.c | 5 | ||||
| -rw-r--r-- | sys/v4l2/gstv4l2videodec.c | 5 | ||||
| -rw-r--r-- | sys/v4l2/gstv4l2videoenc.c | 5 |
3 files changed, 9 insertions, 6 deletions
diff --git a/sys/v4l2/gstv4l2transform.c b/sys/v4l2/gstv4l2transform.c index 2f01375be..806fe7c91 100644 --- a/sys/v4l2/gstv4l2transform.c +++ b/sys/v4l2/gstv4l2transform.c @@ -966,12 +966,13 @@ gst_v4l2_transform_sink_event (GstBaseTransform * trans, GstEvent * event) { GstV4l2Transform *self = GST_V4L2_TRANSFORM (trans); gboolean ret; + GstEventType type = GST_EVENT_TYPE (event); /* Nothing to flush in passthrough */ if (gst_base_transform_is_passthrough (trans)) return GST_BASE_TRANSFORM_CLASS (parent_class)->sink_event (trans, event); - switch (GST_EVENT_TYPE (event)) { + switch (type) { case GST_EVENT_FLUSH_START: GST_DEBUG_OBJECT (self, "flush start"); gst_v4l2_object_unlock (self->v4l2output); @@ -983,7 +984,7 @@ gst_v4l2_transform_sink_event (GstBaseTransform * trans, GstEvent * event) ret = GST_BASE_TRANSFORM_CLASS (parent_class)->sink_event (trans, event); - switch (GST_EVENT_TYPE (event)) { + switch (type) { case GST_EVENT_FLUSH_STOP: /* Buffer should be back now */ GST_DEBUG_OBJECT (self, "flush stop"); diff --git a/sys/v4l2/gstv4l2videodec.c b/sys/v4l2/gstv4l2videodec.c index d6159d3fd..2f6c167dd 100644 --- a/sys/v4l2/gstv4l2videodec.c +++ b/sys/v4l2/gstv4l2videodec.c @@ -869,8 +869,9 @@ gst_v4l2_video_dec_sink_event (GstVideoDecoder * decoder, GstEvent * event) { GstV4l2VideoDec *self = GST_V4L2_VIDEO_DEC (decoder); gboolean ret; + GstEventType type = GST_EVENT_TYPE (event); - switch (GST_EVENT_TYPE (event)) { + switch (type) { case GST_EVENT_FLUSH_START: GST_DEBUG_OBJECT (self, "flush start"); gst_v4l2_object_unlock (self->v4l2output); @@ -882,7 +883,7 @@ gst_v4l2_video_dec_sink_event (GstVideoDecoder * decoder, GstEvent * event) ret = GST_VIDEO_DECODER_CLASS (parent_class)->sink_event (decoder, event); - switch (GST_EVENT_TYPE (event)) { + switch (type) { case GST_EVENT_FLUSH_START: /* The processing thread should stop now, wait for it */ gst_pad_stop_task (decoder->srcpad); diff --git a/sys/v4l2/gstv4l2videoenc.c b/sys/v4l2/gstv4l2videoenc.c index 7e8892314..a9731dc86 100644 --- a/sys/v4l2/gstv4l2videoenc.c +++ b/sys/v4l2/gstv4l2videoenc.c @@ -963,8 +963,9 @@ gst_v4l2_video_enc_sink_event (GstVideoEncoder * encoder, GstEvent * event) { GstV4l2VideoEnc *self = GST_V4L2_VIDEO_ENC (encoder); gboolean ret; + GstEventType type = GST_EVENT_TYPE (event); - switch (GST_EVENT_TYPE (event)) { + switch (type) { case GST_EVENT_FLUSH_START: GST_DEBUG_OBJECT (self, "flush start"); gst_v4l2_object_unlock (self->v4l2output); @@ -976,7 +977,7 @@ gst_v4l2_video_enc_sink_event (GstVideoEncoder * encoder, GstEvent * event) ret = GST_VIDEO_ENCODER_CLASS (parent_class)->sink_event (encoder, event); - switch (GST_EVENT_TYPE (event)) { + switch (type) { case GST_EVENT_FLUSH_START: gst_pad_stop_task (encoder->srcpad); GST_DEBUG_OBJECT (self, "flush start done"); |