bugGnash - The GNU Flash player - Bugs: bug #32527, Improper memory access in...

 
 

bug #32527: Improper memory access in AudioDecoderGst

Submitted by:  Bastiaan Jacques <bjacques>
Submitted on:  Fri 18 Feb 2011 02:33:51 AM UTC  
 
Category: sound-gstSeverity: 5 - Blocker
Release: masterStatus: Fixed
Privacy: PublicAssigned to: Bastiaan Jacques <bjacques>
Open/Closed: Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Fri 18 Feb 2011 02:33:51 AM UTC, original submission:

AudioDecoderGst::setup(GstCaps) destroys the GstCaps pointer that it is passed by AudioDecoderGst ctor. This is fine when the pointer is created in AudioDecoderGst ctor, because then ownership is clear. But in some cases the GstCaps pointer is passed along as part of the AudioInfo structure (a const* argument to AudioDecoderGst ctor):

ExtraInfoGst* extraaudioinfo = dynamic_cast<ExtraInfoGst*>(info.extra.get());

The error here is that |info|'s constness is cast away erroneously. setup() then takes ownership of the GstCaps pointer from this non-const structure.

Later during execution Gnash might try to use the GstCaps pointer again, and hell breaks loose.

This bug requires some refactoring. Patch coming up.

Originally reported at:

https://bugzilla.redhat.com/show_bug.cgi?id=656158

Bastiaan Jacques <bjacques>
Project MemberIn charge of this item.

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by bjacques (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 3 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Thu 24 Feb 2011 01:53:20 AM UTCbjacquesStatusReady For Test=>Fixed
      Open/ClosedOpen=>Closed
    Fri 18 Feb 2011 08:08:18 PM UTCbjacquesStatusIn Progress=>Ready For Test

    Back to the top


    Powered by Savane 3.1-cleanup1