From 09cf44aa13c9896a742839366b46d4b4a472f46b Mon Sep 17 00:00:00 2001 From: Doug Nazar Date: Wed, 21 May 2025 09:36:22 -0400 Subject: [PATCH] validate: Various minor cleanups for lost memory or use after free Includes several missing unref(), clear() or free() calls. Reset current_seek since we just cleared all the seeks. Reset all_configs to NULL to prevent double clearing. Part-of: --- .../gst/validate/gst-validate-mockdecryptor.c | 1 + .../gst/validate/gst-validate-pipeline-monitor.c | 1 + .../validate/gst/validate/gst-validate-reporter.c | 1 + .../validate/gst/validate/gst-validate-scenario.c | 5 +++++ .../gst-devtools/validate/gst/validate/validate.c | 3 ++- .../validate/plugins/ssim/gstvalidatessim.c | 1 + .../validate/tests/check/validate/monitoring.c | 2 ++ .../validate/tests/check/validate/padmonitor.c | 15 ++++++++++----- .../validate/tests/check/validate/reporting.c | 4 ++++ .../validate/tests/check/validate/scenario.c | 3 +++ 10 files changed, 30 insertions(+), 6 deletions(-) diff --git a/subprojects/gst-devtools/validate/gst/validate/gst-validate-mockdecryptor.c b/subprojects/gst-devtools/validate/gst/validate/gst-validate-mockdecryptor.c index 039185d60a..be2a279f8b 100644 --- a/subprojects/gst-devtools/validate/gst/validate/gst-validate-mockdecryptor.c +++ b/subprojects/gst-devtools/validate/gst/validate/gst-validate-mockdecryptor.c @@ -168,6 +168,7 @@ gst_mockdecryptor_transform_caps (GstBaseTransform * base, gst_caps_intersect_full (transformed_caps, filter, GST_CAPS_INTERSECT_FIRST); gst_caps_replace (&transformed_caps, intersection); + gst_caps_unref (intersection); } GST_DEBUG_OBJECT (base, "returning %" GST_PTR_FORMAT, transformed_caps); diff --git a/subprojects/gst-devtools/validate/gst/validate/gst-validate-pipeline-monitor.c b/subprojects/gst-devtools/validate/gst/validate/gst-validate-pipeline-monitor.c index 9d6e8fc8f5..52cf42c448 100644 --- a/subprojects/gst-devtools/validate/gst/validate/gst-validate-pipeline-monitor.c +++ b/subprojects/gst-devtools/validate/gst/validate/gst-validate-pipeline-monitor.c @@ -488,6 +488,7 @@ _append_accept_caps_failure_details (GstValidatePadMonitor * monitor, } } + gst_caps_unref (refused_caps); gst_caps_unref (possible_caps); gst_object_unref (pad); diff --git a/subprojects/gst-devtools/validate/gst/validate/gst-validate-reporter.c b/subprojects/gst-devtools/validate/gst/validate/gst-validate-reporter.c index dc4899be0f..a168ab1ffc 100644 --- a/subprojects/gst-devtools/validate/gst/validate/gst-validate-reporter.c +++ b/subprojects/gst-devtools/validate/gst/validate/gst-validate-reporter.c @@ -90,6 +90,7 @@ gst_validate_reporter_get_priv (GstValidateReporter * reporter) g_direct_equal, NULL, (GDestroyNotify) gst_validate_report_unref); g_mutex_init (&priv->reports_lock); + g_weak_ref_init (&priv->runner, NULL); g_object_set_data_full (G_OBJECT (reporter), REPORTER_PRIVATE, priv, (GDestroyNotify) _free_priv); } diff --git a/subprojects/gst-devtools/validate/gst/validate/gst-validate-scenario.c b/subprojects/gst-devtools/validate/gst/validate/gst-validate-scenario.c index 6ef5fe009a..e34b1e1956 100644 --- a/subprojects/gst-devtools/validate/gst/validate/gst-validate-scenario.c +++ b/subprojects/gst-devtools/validate/gst/validate/gst-validate-scenario.c @@ -2207,6 +2207,7 @@ select_stream_data_free (SelectStreamData * d) { gst_validate_action_unref (d->action); g_list_free_full (d->wanted_streams, g_free); + g_rec_mutex_clear (&d->m); } static void @@ -4387,6 +4388,7 @@ _execute_appsrc_push (GstValidateScenario * scenario, g_signal_emit_by_name (appsink, "pull-sample", &sample, NULL); + g_strfreev (pipeline_elements); goto push_sample; } @@ -5290,6 +5292,7 @@ handle_bus_message (MessageData * d) g_list_free_full (priv->seeks, (GDestroyNotify) gst_validate_seek_information_free); priv->seeks = NULL; + priv->current_seek = NULL; SCENARIO_UNLOCK (scenario); GST_DEBUG_OBJECT (scenario, "Got EOS; generate 'stop' action"); @@ -5958,6 +5961,7 @@ gst_validate_scenario_dispose (GObject * object) } gst_object_replace ((GstObject **) & priv->clock, NULL); + gst_object_unref (runner); G_OBJECT_CLASS (gst_validate_scenario_parent_class)->dispose (object); } @@ -7598,6 +7602,7 @@ _execute_start_http_server (GstValidateScenario * scenario, err->message); REPORT_UNLESS (sscanf (line, "PORT: %d", &port) == 1, done, "Failed to parse port number from server output: %s", line); + g_free (line); server.port = port; server.subprocess = subprocess; diff --git a/subprojects/gst-devtools/validate/gst/validate/validate.c b/subprojects/gst-devtools/validate/gst/validate/validate.c index d142ea5b83..106f234c68 100644 --- a/subprojects/gst-devtools/validate/gst/validate/validate.c +++ b/subprojects/gst-devtools/validate/gst/validate/validate.c @@ -518,7 +518,8 @@ gst_validate_deinit (void) g_list_free (core_config); core_config = NULL; - g_list_free_full (all_configs, (GDestroyNotify) gst_structure_free); + g_list_free_full (g_steal_pointer (&all_configs), + (GDestroyNotify) gst_structure_free); gst_validate_deinit_runner (); gst_validate_scenario_deinit (); diff --git a/subprojects/gst-devtools/validate/plugins/ssim/gstvalidatessim.c b/subprojects/gst-devtools/validate/plugins/ssim/gstvalidatessim.c index 66f6918255..cf65dd15c5 100644 --- a/subprojects/gst-devtools/validate/plugins/ssim/gstvalidatessim.c +++ b/subprojects/gst-devtools/validate/plugins/ssim/gstvalidatessim.c @@ -481,6 +481,7 @@ _set_videoconvert (ValidateSsimOverride * o, caps = gst_pad_get_current_caps (pad); gst_object_unref (pad); gst_caps_replace (&priv->last_caps, caps); + gst_caps_unref (caps); gst_video_info_init (&priv->in_info); gst_video_info_init (&priv->out_info); diff --git a/subprojects/gst-devtools/validate/tests/check/validate/monitoring.c b/subprojects/gst-devtools/validate/tests/check/validate/monitoring.c index fd4bc79d34..04d0a77de7 100644 --- a/subprojects/gst-devtools/validate/tests/check/validate/monitoring.c +++ b/subprojects/gst-devtools/validate/tests/check/validate/monitoring.c @@ -86,6 +86,8 @@ GST_START_TEST (monitors_cleanup) g_object_get_data ((GObject *) sink->sinkpads->data, "validate-monitor"); gst_check_objects_destroyed_on_unref (monitor, pmonitor1, pmonitor2, NULL); gst_check_objects_destroyed_on_unref (pipeline, src, sink, NULL); + + gst_object_unref (runner); } GST_END_TEST; diff --git a/subprojects/gst-devtools/validate/tests/check/validate/padmonitor.c b/subprojects/gst-devtools/validate/tests/check/validate/padmonitor.c index 5d5e731539..66ce394e01 100644 --- a/subprojects/gst-devtools/validate/tests/check/validate/padmonitor.c +++ b/subprojects/gst-devtools/validate/tests/check/validate/padmonitor.c @@ -154,6 +154,7 @@ GST_START_TEST (buffer_before_segment) _check_reports_refcount (srcpad, 2); gst_object_unref (srcpad); gst_check_object_destroyed_on_unref (sink); + gst_object_unref (monitor); ASSERT_OBJECT_REFCOUNT (runner, "runner", 2); gst_object_unref (runner); } @@ -221,11 +222,15 @@ GST_START_TEST (buffer_outside_segment) buffer = gst_discont_buffer_new (); GST_BUFFER_PTS (buffer) = 10 * GST_SECOND; GST_BUFFER_DURATION (buffer) = GST_SECOND; - fail_if (GST_PAD_IS_FLUSHING (gst_element_get_static_pad (identity, - "sink"))); - fail_if (GST_PAD_IS_FLUSHING (gst_element_get_static_pad (identity, - "src"))); - fail_if (GST_PAD_IS_FLUSHING (gst_element_get_static_pad (sink, "sink"))); + pad = gst_element_get_static_pad (identity, "sink"); + fail_if (GST_PAD_IS_FLUSHING (pad)); + gst_clear_object (&pad); + pad = gst_element_get_static_pad (identity, "src"); + fail_if (GST_PAD_IS_FLUSHING (pad)); + gst_clear_object (&pad); + pad = gst_element_get_static_pad (sink, "sink"); + fail_if (GST_PAD_IS_FLUSHING (pad)); + gst_clear_object (&pad); fail_unless_equals_int (gst_pad_push (srcpad, buffer), GST_FLOW_OK); reports = gst_validate_runner_get_reports (runner); diff --git a/subprojects/gst-devtools/validate/tests/check/validate/reporting.c b/subprojects/gst-devtools/validate/tests/check/validate/reporting.c index e83f53b1a3..3a37c45bbb 100644 --- a/subprojects/gst-devtools/validate/tests/check/validate/reporting.c +++ b/subprojects/gst-devtools/validate/tests/check/validate/reporting.c @@ -206,6 +206,10 @@ _create_issues (GstValidateRunner * runner) gst_object_unref (sinkpad); gst_object_unref (funnel_sink1); gst_object_unref (funnel_sink2); + free_element_monitor (fakemixer); + free_element_monitor (sink); + free_element_monitor (src2); + free_element_monitor (src1); gst_check_objects_destroyed_on_unref (fakemixer, funnel_sink1, funnel_sink2, NULL); gst_check_objects_destroyed_on_unref (src1, srcpad1, NULL); diff --git a/subprojects/gst-devtools/validate/tests/check/validate/scenario.c b/subprojects/gst-devtools/validate/tests/check/validate/scenario.c index adaaf31689..0190b11cbe 100644 --- a/subprojects/gst-devtools/validate/tests/check/validate/scenario.c +++ b/subprojects/gst-devtools/validate/tests/check/validate/scenario.c @@ -37,6 +37,9 @@ GST_START_TEST (test_expression_parser) fail_unless_equals_uint64 (start, 50 * GST_SECOND); gst_validate_action_unref (action); + gst_mini_object_unref (GST_MINI_OBJECT (seek_type)); + gst_mini_object_unref (GST_MINI_OBJECT (set_vars)); + gst_object_unref (scenario); gst_object_unref (runner); }