After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 633970 - [icydemux] broken taglist handling
[icydemux] broken taglist handling
Status: RESOLVED FIXED
Product: GStreamer
Classification: Platform
Component: gst-plugins-good
git master
Other Linux
: Normal blocker
: 0.10.26
Assigned To: GStreamer Maintainers
GStreamer Maintainers
Depends on:
Blocks:
 
 
Reported: 2010-11-04 06:42 UTC by Jonathan Matthew
Modified: 2010-11-04 09:36 UTC
See Also:
GNOME target: ---
GNOME version: ---

Attachments
simple fix (1.01 KB, patch)
2010-11-04 06:43 UTC, Jonathan Matthew 		committed Details | Review

Description Jonathan Matthew 2010-11-04 06:42:27 UTC 
This code in icydemux:

  if (GST_EVENT_TYPE (event) == GST_EVENT_TAG) {
    GstTagList *tags;

    gst_event_parse_tag (event, &tags);
    gst_event_unref (event);
    return gst_icydemux_tag_found (icydemux, tags);
  }

uses the taglist after it has been freed, resulting in a critical error during normal ice/shoutcast stream playback.  gst_event_parse_tag does not return a copy of the taglist, it returns a pointer to the taglist owned by the event.
Comment 1 Jonathan Matthew 2010-11-04 06:43:13 UTC 
Created attachment 173813 [details] [review]
simple fix
Comment 2 Sebastian Dröge (slomo) 2010-11-04 09:32:23 UTC 
Comment on attachment 173813 [details] [review]
simple fix

The patch looks good and should get into this release. Note that gst_icydemux_tag_found() takes a copy of the taglist internally, different than gst_element_found_tags() for example, so this patch is really correct.
Comment 3 Tim-Philipp Müller 2010-11-04 09:36:32 UTC 
Nice catch, and just in time. Thanks!

 commit 5b68b64617f08939e2b14a0ad88e1996504c544d
 Author: Jonathan Matthew <jonathan@d14n.org>
 Date:   Thu Nov 4 16:42:07 2010 +1000

    icydemux: fix use-after-free of taglist
    
    Broken by commit 4c2f5333 (bug #630205).
    
    https://bugzilla.gnome.org/show_bug.cgi?id=633970