After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 462085 - registry feature hash can access invalid memory
registry feature hash can access invalid memory
Status: RESOLVED FIXED
Product: GStreamer
Classification: Platform
Component: gstreamer (core)
git master
Other Linux
: Normal blocker
: 0.10.14
Assigned To: Jan Schmidt
GStreamer Maintainers
Depends on:
Blocks:
 
 
Reported: 2007-07-31 11:13 UTC by Jan Schmidt
Modified: 2007-07-31 11:53 UTC
See Also:
GNOME target: ---
GNOME version: ---

Attachments
proposed patch for registry hash (1.45 KB, patch)
2007-07-31 11:40 UTC, Jan Schmidt 		none Details | Review

Description Jan Schmidt 2007-07-31 11:13:48 UTC 
When replacing an existing feature in the registry, the new feature hash might access invalid memory because the old feature has been unreffed (freeing the name string), but the registry feature hash stores a pointer to the name, not a copy.
Comment 1 Jan Schmidt 2007-07-31 11:40:18 UTC 
Created attachment 92785 [details] [review]
proposed patch for registry hash

This patch makes sure that when replacing an existing pluginfeature, the existing  feature is not unreffed until after the name string is no longer need - by using g_hash_table_replace instead of g_hash_table_insert and unreffing the old feature afterward.
Comment 2 Jan Schmidt 2007-07-31 11:53:02 UTC 
Committed after a brief review on IRC:

2007-07-31  Jan Schmidt  <thaytan@mad.scientist.com>

        * gst/gstregistry.c: (gst_registry_add_feature):
        When replacing an existing feature in the registry, make sure to
        continue holding a reference until we've replaced the name string
        within our feature hash table. Make sure to use g_hash_table_replace
        instead of g_hash_table_insert to ensure the new name string is used
        as a key instead of the old one that we're about to free.
        Fixes: #462085