diff options
| author | Matthew Waters <matthew@centricular.com> | 2020-05-29 22:21:10 +1000 |
|---|---|---|
| committer | Matthew Waters <matthew@centricular.com> | 2020-06-02 13:58:13 +1000 |
| commit | a4d900332bae1648c034b827ac0eefbf87faaee6 (patch) | |
| tree | 03dacb4658003ebc466cbc3a15b3dccc3a888c3a /gst-libs/gst/vulkan | |
| parent | dd44bc3a2dd4e380eb8afbb591d68706950ebe70 (diff) | |
| download | gstreamer-plugins-bad-a4d900332bae1648c034b827ac0eefbf87faaee6.tar.gz | |
vulkanimagememory: fix use-after-free releasing a view
If the view has the last reference to the image, then
gst_clear_mini_object will destroy the image and the lock used in the
next line.
Part-of: <https://gitlab.freedesktop.org/gstreamer/gst-plugins-bad/-/merge_requests/1314>
Diffstat (limited to 'gst-libs/gst/vulkan')
| -rw-r--r-- | gst-libs/gst/vulkan/gstvkimagememory.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/gst-libs/gst/vulkan/gstvkimagememory.c b/gst-libs/gst/vulkan/gstvkimagememory.c index 711df1ca8..49c0bd6b1 100644 --- a/gst-libs/gst/vulkan/gstvkimagememory.c +++ b/gst-libs/gst/vulkan/gstvkimagememory.c @@ -549,6 +549,7 @@ gst_vulkan_image_memory_release_view (GstVulkanImageMemory * image, guint index; g_return_if_fail (gst_is_vulkan_image_memory (GST_MEMORY_CAST (image))); + g_return_if_fail (image == view->image); g_mutex_lock (&image->lock); GST_CAT_TRACE (GST_CAT_VULKAN_IMAGE_MEMORY, "image %p removing view %p", @@ -561,8 +562,9 @@ gst_vulkan_image_memory_release_view (GstVulkanImageMemory * image, g_warning ("GstVulkanImageMemory:%p attempt to remove a view %p " "that we do not own", image, view); } - gst_clear_mini_object ((GstMiniObject **) & view->image); + view->image = NULL; g_mutex_unlock (&image->lock); + gst_memory_unref ((GstMemory *) image); } /** |