GNOME Bugzilla – Bug 764231
Bad call to gst_buffer_add_video_gl_texture_upload_meta() in gstvaapivideometa_texture.c
Last modified: 2016-03-30 20:59:31 UTC
the code of the method gst_buffer_add_texture_upload_meta is not compatible with the gst_buffer_add_video_gl_texture_upload_meta api : the call need a GstVideoGLTextureType[4] (because a memcpy is made on the 4 elements) and only a GstVideoGLTextureType[1] is given => buffer overflow
Created attachment 324867 [details] [review] gltextureupload: use an array for texture type Instead of using a single value for the texture type, use an array with 4 elements, just as the GstVideoGLTextureUploadMeta, avoiding a buffer overflow.
Review of attachment 324867 [details] [review]: ::: gst/vaapi/gstvaapivideometa_texture.c @@ +74,3 @@ GstVideoFormat format) { + memset (meta->texture_type, 0, sizeof (meta->texture_type[0]) * 4); memset (meta->texture_type, 0, sizeof (meta->texture_type)); No need to hardcode the 4 in all the places
Created attachment 324870 [details] [review] gltextureupload: use an array for texture type Instead of using a single value for the texture type, use an array with 4 elements, just as the GstVideoGLTextureUploadMeta, avoiding a buffer overflow.
(In reply to Sebastian Dröge (slomo) from comment #2) > Review of attachment 324867 [details] [review] [review]: > > ::: gst/vaapi/gstvaapivideometa_texture.c > @@ +74,3 @@ > GstVideoFormat format) > { > + memset (meta->texture_type, 0, sizeof (meta->texture_type[0]) * 4); > > memset (meta->texture_type, 0, sizeof (meta->texture_type)); > > No need to hardcode the 4 in all the places :) Thanks!
Should also go into the 1.8 branch btw. Please backport everything that seems safe enough and is a bugfix to 1.8 :)
Attachment 324870 [details] pushed as ddddb04 - gltextureupload: use an array for texture type