bugGnash - The GNU Flash player - Bugs: bug #32527, Improper memory access in...

 
 

bug #32527: Improper memory access in AudioDecoderGst

Submitter:  Bastiaan Jacques <bjacques>
Submitted:  Fri 18 Feb 2011 02:33:51 AM UTC
   
 
Category:  sound-gst Severity:  5 - Blocker
Release:  master Status:  Fixed
Privacy:  Public Assigned to:  bjacques
Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Fri 18 Feb 2011 02:33:51 AM UTC, original submission:  

AudioDecoderGst::setup(GstCaps*) destroys the GstCaps pointer that it is passed by AudioDecoderGst ctor. This is fine when the pointer is created in AudioDecoderGst ctor, because then ownership is clear. But in some cases the GstCaps pointer is passed along as part of the AudioInfo structure (a const argument to AudioDecoderGst ctor):

ExtraInfoGst* extraaudioinfo = dynamic_cast<ExtraInfoGst*>(info.extra.get());

The error here is that |info|'s constness is cast away erroneously. setup() then takes ownership of the  GstCaps pointer from this non-const structure.

Later during execution Gnash might try to use the GstCaps pointer again, and hell breaks loose.

This bug requires some refactoring. Patch coming up.

Originally reported at:

https://bugzilla.redhat.com/show_bug.cgi?id=656158

Bastiaan Jacques <bjacques>
Group Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by bjacques (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2011-02-24 bjacques StatusReady For Test Fixed
        Open/ClosedOpen Closed
    2011-02-18 bjacques StatusIn Progress Ready For Test

    Back to the top

    Powered by Savane 3.13-f8d8.
    Corresponding source code