After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 557649 - GstBaseTransform can cause ivalid memory references
GstBaseTransform can cause ivalid memory references
Status: RESOLVED FIXED
Product: GStreamer
Classification: Platform
Component: gstreamer (core)
0.10.21
Other Linux
: Normal critical
: 0.10.22
Assigned To: GStreamer Maintainers
GStreamer Maintainers
Depends on:
Blocks:
 
 
Reported: 2008-10-23 18:44 UTC by Branko Čibej
Modified: 2008-10-24 09:45 UTC
See Also:
GNOME target: ---
GNOME version: ---

Attachments
Reproduction recipes (3.25 KB, text/plain)
2008-10-23 18:47 UTC, Branko Čibej 		  Details
Workaround? (336 bytes, patch)
2008-10-23 19:18 UTC, Branko Čibej 		rejected Details | Review

Description Branko Čibej 2008-10-23 18:44:58 UTC 
When the following conditions are met:
* (part) of the pipeline is in pull mode
* there are at least two elements based on GstBaseTransform there
* at least the first of those elements is in pass-through mode
gst_base_transform_handle_buffer will eventually try to unref an unallocated buffer.

This is a regression since 0.10.18.

Examples attached.
Comment 1 Branko Čibej 2008-10-23 18:47:25 UTC 
Created attachment 121214 [details]
Reproduction recipes
Comment 2 Branko Čibej 2008-10-23 19:18:37 UTC 
Created attachment 121215 [details] [review]
Workaround?

This simple patch makes all my real test cases work again. But I've no idea how this could've worked in 0.10.18 without a similar change.
Comment 3 Wim Taymans 2008-10-24 09:45:23 UTC 
The problem was indeed an uninitialized variable in the prepare_output_buffer function. Your patch however initialized the wrong variable which accidentally made it work.

        * libs/gst/base/gstbasetransform.c:
        (gst_base_transform_prepare_output_buffer),
        (gst_base_transform_getrange):
        Clear the output buffer variable.
        Cleanups to the error path in the getrange function.
        Fixes #557649.