diff options
| author | Andreas Rheinhardt <[email protected]> | 2021-10-06 17:21:04 +0200 |
|---|---|---|
| committer | Andreas Rheinhardt <[email protected]> | 2022-01-11 15:15:53 +0100 |
| commit | bdb5f6e7f8ea9b37e0dedd34b4ef1887c02d4db4 (patch) | |
| tree | 568c8e0d6a1e66b01b31b9ef4f1b95c49e47c97f | |
| parent | 566d7896c116f1a16935b5b28599598a2e69e113 (diff) | |
avfilter/asrc_flite: Fix use-after-frees
When an flite filter instance is uninitialized and the refcount
of the corresponding voice_entry reaches zero, the voice is
unregistered, yet the voice_entry's pointer to the voice is not reset.
(Whereas some other pointers are needlessly reset.)
Because of this a new flite filter instance will believe said voice
to already be registered, leading to use-after-frees.
Fix this by resetting the right pointer instead of the wrong ones.
Reviewed-by: Paul B Mahol <[email protected]>
Signed-off-by: Andreas Rheinhardt <[email protected]>
(cherry picked from commit 18ddb25c7a58404641de2f6aa68220bd509e376c)
| -rw-r--r-- | libavfilter/asrc_flite.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/libavfilter/asrc_flite.c b/libavfilter/asrc_flite.c index 71924e7e1a..6373ae761d 100644 --- a/libavfilter/asrc_flite.c +++ b/libavfilter/asrc_flite.c @@ -197,10 +197,10 @@ static av_cold void uninit(AVFilterContext *ctx) FliteContext *flite = ctx->priv; if (flite->voice_entry) { - if (!--flite->voice_entry->usage_count) + if (!--flite->voice_entry->usage_count) { flite->voice_entry->unregister_fn(flite->voice); - flite->voice = NULL; - flite->voice_entry = NULL; + flite->voice_entry->voice = NULL; + } } delete_wave(flite->wave); flite->wave = NULL; |