vlc/vlc-3.0 | branch: master | Hugo Beauzée-Luyssen <[email protected]> | Fri Nov 23 14:53:24 2018 +0100| [e969030b6e4c23f851d8449526d0af53bbe6108f] | committer: Hugo Beauzée-Luyssen
sd: avahi: Fix potential use after free A SD user might want to use the fields of the removed item, which can't be done if it gets released immediatly after being sent. (cherry picked from commit d79805c5fef70bdeb45255078f57dd08b9b8fefc) Signed-off-by: Hugo Beauzée-Luyssen <[email protected]> > http://git.videolan.org/gitweb.cgi/vlc/vlc-3.0.git/?a=commit;h=e969030b6e4c23f851d8449526d0af53bbe6108f --- modules/services_discovery/avahi.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/modules/services_discovery/avahi.c b/modules/services_discovery/avahi.c index dbfac40809..1457c75a61 100644 --- a/modules/services_discovery/avahi.c +++ b/modules/services_discovery/avahi.c @@ -206,7 +206,6 @@ static void resolve_callback( vlc_dictionary_insert( &p_sys->services_name_to_input_item, name, p_input ); services_discovery_AddItem( p_sd, p_input ); - input_item_Release( p_input ); } } @@ -257,10 +256,17 @@ static void browse_callback( vlc_dictionary_remove_value_for_key( &p_sys->services_name_to_input_item, name, NULL, NULL ); + input_item_Release( p_item ); } } } +static void clear_item( void* p_item, void* p_obj ) +{ + VLC_UNUSED( p_obj ); + input_item_Release( (input_item_t*)p_item ); +} + /***************************************************************************** * Open: initialize and create stuff *****************************************************************************/ @@ -318,7 +324,7 @@ error: if( p_sys->poll != NULL ) avahi_threaded_poll_free( p_sys->poll ); - vlc_dictionary_clear( &p_sys->services_name_to_input_item, NULL, NULL ); + vlc_dictionary_clear( &p_sys->services_name_to_input_item, clear_item, NULL ); free( p_sys ); return VLC_EGENERIC; @@ -336,6 +342,6 @@ static void Close( vlc_object_t *p_this ) avahi_client_free( p_sys->client ); avahi_threaded_poll_free( p_sys->poll ); - vlc_dictionary_clear( &p_sys->services_name_to_input_item, NULL, NULL ); + vlc_dictionary_clear( &p_sys->services_name_to_input_item, clear_item, NULL ); free( p_sys ); } _______________________________________________ vlc-commits mailing list [email protected] https://mailman.videolan.org/listinfo/vlc-commits
