diff options
| author | Guillaume Desmottes <guillaume.desmottes@collabora.co.uk> | 2017-09-08 14:57:06 +0200 |
|---|---|---|
| committer | Nicolas Dufresne <nicolas.dufresne@collabora.com> | 2017-09-08 09:36:42 -0400 |
| commit | 2b8edd9c0f23e1aedc68fd2271931bce707d2ac4 (patch) | |
| tree | 0297ad40927b632addbe51a140c93564402fa20f | |
| parent | cf0067392d19d2516d4f558649e657db3e008535 (diff) | |
| download | gstreamer-plugins-bad-2b8edd9c0f23e1aedc68fd2271931bce707d2ac4.tar.gz | |
kms: fix crash if bo allocation failed when copying to dumb buffer
If bo allocation failed we destroy the buffer and return GST_FLOW_ERROR,
but the @buffer pointer was still pointing to the address of the
destroyed buffer. gst_kms_sink_copy_to_dumb_buffer() was then trying to
unref it when bailing out causing a crash.
Leave @buffer untouched if allocation failed to fix the crash.
Also remove the check on *buffer being not NULL as gst_buffer_new()
will abort if it failed.
https://bugzilla.gnome.org/show_bug.cgi?id=787442
| -rw-r--r-- | sys/kms/gstkmsbufferpool.c | 9 |
1 files changed, 3 insertions, 6 deletions
diff --git a/sys/kms/gstkmsbufferpool.c b/sys/kms/gstkmsbufferpool.c index 329135c10..39512427d 100644 --- a/sys/kms/gstkmsbufferpool.c +++ b/sys/kms/gstkmsbufferpool.c @@ -139,14 +139,11 @@ gst_kms_buffer_pool_alloc_buffer (GstBufferPool * pool, GstBuffer ** buffer, priv = vpool->priv; info = &priv->vinfo; - *buffer = gst_buffer_new (); - if (*buffer == NULL) - goto no_memory; mem = gst_kms_allocator_bo_alloc (priv->allocator, info); - if (!mem) { - gst_buffer_unref (*buffer); + if (!mem) goto no_memory; - } + + *buffer = gst_buffer_new (); gst_buffer_append_memory (*buffer, mem); if (priv->add_videometa) { |