don't pass random pointers to pull_range

8 files changed, 26 insertions, 8 deletions

diff --git a/gst/asfmux/gstasfparse.c b/gst/asfmux/gstasfparse.c
index ab1f69152..40231f6d8 100644
--- a/gst/asfmux/gstasfparse.c
+++ b/gst/asfmux/gstasfparse.c
@@ -226,12 +226,13 @@ gst_asf_parse_pull_packets (GstAsfParse * asfparse)
   GstFlowReturn ret;
   while (asfparse->asfinfo->broadcast ||
       asfparse->parsed_packets < asfparse->asfinfo->packets_count) {
-    GstBuffer *packet = NULL;
+    GstBuffer *packet;
 
     GST_DEBUG_OBJECT (asfparse, "Parsing packet %" G_GUINT64_FORMAT,
         asfparse->parsed_packets);
 
     /* get the packet */
+    packet = NULL;
     ret = gst_pad_pull_range (asfparse->sinkpad, asfparse->offset,
         asfparse->asfinfo->packet_size, &packet);
     if (ret != GST_FLOW_OK)
@@ -250,11 +251,12 @@ gst_asf_parse_pull_packets (GstAsfParse * asfparse)
 static GstFlowReturn
 gst_asf_parse_pull_indexes (GstAsfParse * asfparse)
 {
-  GstBuffer *guid_and_size = NULL;
-  GstBuffer *buf = NULL;
+  GstBuffer *guid_and_size;
+  GstBuffer *buf;
   guint64 obj_size;
   GstFlowReturn ret = GST_FLOW_OK;
   while (1) {
+    guid_and_size = NULL;
     ret = gst_pad_pull_range (asfparse->sinkpad, asfparse->offset,
         ASF_GUID_OBJSIZE_SIZE, &guid_and_size);
     if (ret != GST_FLOW_OK)
@@ -271,6 +273,7 @@ gst_asf_parse_pull_indexes (GstAsfParse * asfparse)
     asfparse->offset += ASF_GUID_OBJSIZE_SIZE;
 
     /* pull the rest of the object */
+    buf = NULL;
     ret = gst_pad_pull_range (asfparse->sinkpad, asfparse->offset, obj_size,
         &buf);
     if (ret != GST_FLOW_OK) {
diff --git a/gst/cdxaparse/gstcdxaparse.c b/gst/cdxaparse/gstcdxaparse.c
index dc9f949f8..8bd22c656 100644
--- a/gst/cdxaparse/gstcdxaparse.c
+++ b/gst/cdxaparse/gstcdxaparse.c
@@ -292,6 +292,7 @@ gst_cdxa_parse_loop (GstPad * sinkpad)
 
     req = 8 + GST_CDXA_SECTOR_SIZE;     /* riff chunk header = 8 bytes */
 
+    buf = NULL;
     flow_ret = gst_pad_pull_range (cdxa->sinkpad, cdxa->offset, req, &buf);
 
     if (flow_ret != GST_FLOW_OK) {
@@ -330,6 +331,7 @@ gst_cdxa_parse_loop (GstPad * sinkpad)
   GST_DEBUG_OBJECT (cdxa, "pulling buffer at offset 0x%" G_GINT64_MODIFIER "x",
       cdxa->offset);
 
+  buf = NULL;
   flow_ret = gst_pad_pull_range (cdxa->sinkpad, cdxa->offset,
       GST_CDXA_SECTOR_SIZE, &buf);
 
diff --git a/gst/mpegdemux/gstmpegdemux.c b/gst/mpegdemux/gstmpegdemux.c
index 8e7bd2310..1b67ce0d0 100644
--- a/gst/mpegdemux/gstmpegdemux.c
+++ b/gst/mpegdemux/gstmpegdemux.c
@@ -2472,7 +2472,7 @@ gst_flups_demux_scan_forward_ts (GstFluPSDemux * demux, guint64 * pos,
     SCAN_MODE mode, guint64 * rts, gint limit)
 {
   GstFlowReturn ret = GST_FLOW_OK;
-  GstBuffer *buffer = NULL;
+  GstBuffer *buffer;
   guint64 offset = *pos;
   gboolean found = FALSE;
   guint64 ts = 0;
@@ -2492,6 +2492,7 @@ gst_flups_demux_scan_forward_ts (GstFluPSDemux * demux, guint64 * pos,
       to_read = demux->sink_segment.stop - offset;
 
     /* read some data */
+    buffer = NULL;
     ret = gst_pad_pull_range (demux->sinkpad, offset, to_read, &buffer);
     if (G_UNLIKELY (ret != GST_FLOW_OK))
       return FALSE;
@@ -2531,7 +2532,7 @@ gst_flups_demux_scan_backward_ts (GstFluPSDemux * demux, guint64 * pos,
     SCAN_MODE mode, guint64 * rts, gint limit)
 {
   GstFlowReturn ret = GST_FLOW_OK;
-  GstBuffer *buffer = NULL;
+  GstBuffer *buffer;
   guint64 offset = *pos;
   gboolean found = FALSE;
   guint64 ts = 0;
@@ -2555,6 +2556,7 @@ gst_flups_demux_scan_backward_ts (GstFluPSDemux * demux, guint64 * pos,
       offset = 0;
     }
     /* read some data */
+    buffer = NULL;
     ret = gst_pad_pull_range (demux->sinkpad, offset, to_read, &buffer);
     if (G_UNLIKELY (ret != GST_FLOW_OK))
       return FALSE;
@@ -2712,7 +2714,8 @@ gst_flups_demux_pull_block (GstPad * pad, GstFluPSDemux * demux,
     guint64 offset, guint size)
 {
   GstFlowReturn ret = GST_FLOW_OK;
-  GstBuffer *buffer;
+  GstBuffer *buffer = NULL;
+
   ret = gst_pad_pull_range (pad, offset, size, &buffer);
   if (G_UNLIKELY (ret != GST_FLOW_OK)) {
     GST_DEBUG_OBJECT (demux, "pull range at %" G_GUINT64_FORMAT
diff --git a/gst/mpegtsdemux/mpegtsbase.c b/gst/mpegtsdemux/mpegtsbase.c
index 9b30a1d5c..2e4fcedb5 100644
--- a/gst/mpegtsdemux/mpegtsbase.c
+++ b/gst/mpegtsdemux/mpegtsbase.c
@@ -1373,6 +1373,7 @@ mpegts_base_scan (MpegTSBase * base)
     GST_DEBUG ("Grabbing %d => %d", i * 50 * MPEGTS_MAX_PACKETSIZE,
         50 * MPEGTS_MAX_PACKETSIZE);
 
+    buf = NULL;
     ret = gst_pad_pull_range (base->sinkpad, i * 50 * MPEGTS_MAX_PACKETSIZE,
         50 * MPEGTS_MAX_PACKETSIZE, &buf);
     if (G_UNLIKELY (ret != GST_FLOW_OK))
@@ -1433,7 +1434,7 @@ mpegts_base_loop (MpegTSBase * base)
       break;
     case BASE_MODE_STREAMING:
     {
-      GstBuffer *buf;
+      GstBuffer *buf = NULL;
 
       GST_DEBUG ("Pulling data from %" G_GUINT64_FORMAT, base->seek_offset);
 
diff --git a/gst/mpegtsdemux/tsdemux.c b/gst/mpegtsdemux/tsdemux.c
index f3a32d4b9..8cce9cd23 100644
--- a/gst/mpegtsdemux/tsdemux.c
+++ b/gst/mpegtsdemux/tsdemux.c
@@ -523,6 +523,7 @@ gst_ts_demux_perform_auxiliary_seek (MpegTSBase * base, GstClockTime seektime,
     offset -= 4;
 
   while (!done && scan_offset <= length) {
+    buf = NULL;
     res =
         gst_pad_pull_range (base->sinkpad, offset + scan_offset,
         50 * MPEGTS_MAX_PACKETSIZE, &buf);
@@ -1497,6 +1498,7 @@ find_pcr_packet (MpegTSBase * base, guint64 offset, gint64 length,
     offset -= 4;
 
   while (!done && scan_offset < length) {
+    buf = NULL;
     ret =
         gst_pad_pull_range (base->sinkpad, offset + scan_offset,
         50 * MPEGTS_MAX_PACKETSIZE, &buf);
@@ -1604,6 +1606,7 @@ find_timestamps (MpegTSBase * base, guint64 initoff, guint64 * offset)
   /* Start scanning from now PAT offset */
 
   while (!done) {
+    buf = NULL;
     ret = gst_pad_pull_range (base->sinkpad, i * 50 * MPEGTS_MAX_PACKETSIZE,
         50 * MPEGTS_MAX_PACKETSIZE, &buf);
 
@@ -1654,6 +1657,7 @@ find_timestamps (MpegTSBase * base, guint64 initoff, guint64 * offset)
       " and the end:%" G_GINT64_FORMAT, scan_offset, total_bytes);
 
   while ((!done) && (scan_offset < total_bytes)) {
+    buf = NULL;
     ret = gst_pad_pull_range (base->sinkpad, scan_offset,
         50 * MPEGTS_MAX_PACKETSIZE, &buf);
 
@@ -1742,6 +1746,7 @@ process_pcr (MpegTSBase * base, guint64 initoff, TSPcrOffset * pcroffset,
     GstMapInfo map;
     gsize size;
 
+    buf = NULL;
     ret = gst_pad_pull_range (base->sinkpad,
         initoff + i * 500 * base->packetsize, 500 * base->packetsize, &buf);
 
diff --git a/gst/mxf/mxfdemux.c b/gst/mxf/mxfdemux.c
index f56c4f386..0be16b3b8 100644
--- a/gst/mxf/mxfdemux.c
+++ b/gst/mxf/mxfdemux.c
@@ -2032,6 +2032,7 @@ gst_mxf_demux_pull_random_index_pack (GstMXFDemux * demux)
 
   g_assert (filesize > 4);
 
+  buffer = NULL;
   if ((ret =
           gst_mxf_demux_pull_range (demux, filesize - 4, 4,
               &buffer)) != GST_FLOW_OK) {
@@ -2051,6 +2052,7 @@ gst_mxf_demux_pull_random_index_pack (GstMXFDemux * demux)
     return;
   }
 
+  buffer = NULL;
   if ((ret =
           gst_mxf_demux_pull_range (demux, filesize - pack_size, 16,
               &buffer)) != GST_FLOW_OK) {
@@ -2692,7 +2694,7 @@ gst_mxf_demux_loop (GstPad * pad)
     /* Skip run-in, which is at most 64K and is finished
      * by a header partition pack */
     while (demux->offset < 64 * 1024) {
-      GstBuffer *buffer;
+      GstBuffer *buffer = NULL;
 
       if ((ret =
               gst_mxf_demux_pull_range (demux, demux->offset, 16,
diff --git a/gst/nuvdemux/gstnuvdemux.c b/gst/nuvdemux/gstnuvdemux.c
index 7569eb30b..5aca5443a 100644
--- a/gst/nuvdemux/gstnuvdemux.c
+++ b/gst/nuvdemux/gstnuvdemux.c
@@ -544,6 +544,7 @@ gst_nuv_demux_stream_mpeg_data (GstNuvDemux * nuv)
   GstFlowReturn ret = GST_FLOW_OK;
 
   /* ffmpeg extra data */
+  nuv->mpeg_buffer = NULL;
   ret =
       gst_nuv_demux_read_bytes (nuv, nuv->mpeg_data_size, TRUE,
       &nuv->mpeg_buffer);
diff --git a/gst/rawparse/gstrawparse.c b/gst/rawparse/gstrawparse.c
index 2148ca7f6..fd966f56f 100644
--- a/gst/rawparse/gstrawparse.c
+++ b/gst/rawparse/gstrawparse.c
@@ -366,6 +366,7 @@ gst_raw_parse_loop (GstElement * element)
     rp->offset -= size;
   }
 
+  buffer = NULL;
   ret = gst_pad_pull_range (rp->sinkpad, rp->offset, size, &buffer);
 
   if (ret != GST_FLOW_OK) {