When an flite filter instance is uninitialized and the refcount
of the corresponding voice_entry reaches zero, the voice is
unregistered, yet the voice_entry's pointer to the voice is not reset.
(Whereas some other pointers are needlessly reset.)
Because of this a new flite filter instance will believe said voice
to already be registered, leading to use-after-frees.
Fix this by resetting the right pointer instead of the wrong ones.
Signed-off-by: Andreas Rheinhardt <andreas.rheinha...@outlook.com>
---
libavfilter/asrc_flite.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/libavfilter/asrc_flite.c b/libavfilter/asrc_flite.c
index 0789dd6ff3..bd2ae774de 100644
--- a/libavfilter/asrc_flite.c
+++ b/libavfilter/asrc_flite.c
@@ -197,10 +197,10 @@ static av_cold void uninit(AVFilterContext *ctx)
FliteContext *flite = ctx->priv;
if (flite->voice_entry) {
- if (!--flite->voice_entry->usage_count)
+ if (!--flite->voice_entry->usage_count) {
flite->voice_entry->unregister_fn(flite->voice);
- flite->voice = NULL;
- flite->voice_entry = NULL;
+ flite->voice_entry->voice = NULL;
+ }
}
delete_wave(flite->wave);
flite->wave = NULL;
--
2.30.2
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
