vlc | branch: master | Hugo Beauzée-Luyssen <[email protected]> | Fri Nov 23 14:53:24 2018 +0100| [d79805c5fef70bdeb45255078f57dd08b9b8fefc] | committer: Hugo Beauzée-Luyssen
sd: avahi: Fix potential use after free A SD user might want to use the fields of the removed item, which can't be done if it gets released immediatly after being sent. > http://git.videolan.org/gitweb.cgi/vlc.git/?a=commit;h=d79805c5fef70bdeb45255078f57dd08b9b8fefc --- modules/services_discovery/avahi.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/modules/services_discovery/avahi.c b/modules/services_discovery/avahi.c index 67d373b864..e5696320b7 100644 --- a/modules/services_discovery/avahi.c +++ b/modules/services_discovery/avahi.c @@ -348,7 +348,6 @@ static void resolve_callback( vlc_dictionary_insert( &p_sys->services_name_to_input_item, name, p_input ); services_discovery_AddItem( p_sd, p_input ); - input_item_Release( p_input ); } } @@ -407,10 +406,17 @@ static void browse_callback( vlc_dictionary_remove_value_for_key( &p_sys->services_name_to_input_item, name, NULL, NULL ); + input_item_Release( p_item ); } } } +static void clear_item( void* p_item, void* p_obj ) +{ + VLC_UNUSED( p_obj ); + input_item_Release( (input_item_t*)p_item ); +} + /***************************************************************************** * Open: initialize and create stuff *****************************************************************************/ @@ -463,7 +469,7 @@ error: if( p_sys->poll != NULL ) avahi_threaded_poll_free( p_sys->poll ); - vlc_dictionary_clear( &p_sys->services_name_to_input_item, NULL, NULL ); + vlc_dictionary_clear( &p_sys->services_name_to_input_item, clear_item, NULL ); free( p_sys ); return VLC_EGENERIC; @@ -506,7 +512,7 @@ static void CloseCommon( discovery_sys_t *p_sys ) avahi_client_free( p_sys->client ); avahi_threaded_poll_free( p_sys->poll ); - vlc_dictionary_clear( &p_sys->services_name_to_input_item, NULL, NULL ); + vlc_dictionary_clear( &p_sys->services_name_to_input_item, clear_item, NULL ); free( p_sys ); } _______________________________________________ vlc-commits mailing list [email protected] https://mailman.videolan.org/listinfo/vlc-commits
