diff mbox series

[FFmpeg-devel,6/8] avfilter/asrc_flite: Fix use-after-frees

Message ID AM7PR03MB666097EB473611730A075B568FB19@AM7PR03MB6660.eurprd03.prod.outlook.com
State Accepted
Commit 18ddb25c7a58404641de2f6aa68220bd509e376c
Headers show
Series [FFmpeg-devel,1/8] avfilter/vf_w3fdif: Fix segfault on allocation error | expand

Checks

Context Check Description
andriy/make_x86 success Make finished
andriy/make_fate_x86 success Make fate finished
andriy/make_ppc success Make finished
andriy/make_fate_ppc success Make fate finished

Commit Message

Andreas Rheinhardt Oct. 7, 2021, 9:31 a.m. UTC 
When an flite filter instance is uninitialized and the refcount
of the corresponding voice_entry reaches zero, the voice is
unregistered, yet the voice_entry's pointer to the voice is not reset.
(Whereas some other pointers are needlessly reset.)
Because of this a new flite filter instance will believe said voice
to already be registered, leading to use-after-frees.
Fix this by resetting the right pointer instead of the wrong ones.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
---
 libavfilter/asrc_flite.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

Comments

Paul B Mahol Oct. 7, 2021, 11:07 a.m. UTC | #1 
probably ok
diff mbox series

Patch

diff --git a/libavfilter/asrc_flite.c b/libavfilter/asrc_flite.c
index 0789dd6ff3..bd2ae774de 100644
--- a/libavfilter/asrc_flite.c
+++ b/libavfilter/asrc_flite.c
@@ -197,10 +197,10 @@  static av_cold void uninit(AVFilterContext *ctx)
     FliteContext *flite = ctx->priv;
 
     if (flite->voice_entry) {
-        if (!--flite->voice_entry->usage_count)
+        if (!--flite->voice_entry->usage_count) {
             flite->voice_entry->unregister_fn(flite->voice);
-        flite->voice = NULL;
-        flite->voice_entry = NULL;
+            flite->voice_entry->voice = NULL;
+        }
     }
     delete_wave(flite->wave);
     flite->wave = NULL;