FaSTTUBe/GST-Tensordecoder-ov_ep
35
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

vulkanimagememory: fix use-after-free releasing a view

Browse Source 
If the view has the last reference to the image, then
gst_clear_mini_object will destroy the image and the lock used in the
next line.

Part-of: <https://gitlab.freedesktop.org/gstreamer/gst-plugins-bad/-/merge_requests/1314>
This commit is contained in:
Matthew Waters 2020-05-29 22:21:10 +10:00
parent dd44bc3a2d
commit a4d900332b
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
gst-libs/gst/vulkan/gstvkimagememory.c
View File

@ -549,6 +549,7 @@ gst_vulkan_image_memory_release_view (GstVulkanImageMemory * image,
guint index; guint index;
g_return_if_fail (gst_is_vulkan_image_memory (GST_MEMORY_CAST (image))); g_return_if_fail (gst_is_vulkan_image_memory (GST_MEMORY_CAST (image)));
g_return_if_fail (image == view->image);
g_mutex_lock (&image->lock); g_mutex_lock (&image->lock);
GST_CAT_TRACE (GST_CAT_VULKAN_IMAGE_MEMORY, "image %p removing view %p", GST_CAT_TRACE (GST_CAT_VULKAN_IMAGE_MEMORY, "image %p removing view %p",
@ -561,8 +562,9 @@ gst_vulkan_image_memory_release_view (GstVulkanImageMemory * image,
g_warning ("GstVulkanImageMemory:%p attempt to remove a view %p " g_warning ("GstVulkanImageMemory:%p attempt to remove a view %p "
"that we do not own", image, view); "that we do not own", image, view);
} }
gst_clear_mini_object ((GstMiniObject **) & view->image); view->image = NULL;
g_mutex_unlock (&image->lock); g_mutex_unlock (&image->lock);
gst_memory_unref ((GstMemory *) image);
} }
/** /**