[vlc-commits] commit: XVideo: use after free ( Rémi Denis-Courmont )

[git at videolan.org]

vlc | branch: master | Rémi Denis-Courmont <remi at remlab.net> | Thu Nov  4 20:03:04 2010 +0200| [d3b67d8fc36ea550324859846147d376fd387795] | committer: Rémi Denis-Courmont 

XVideo: use after free

> http://git.videolan.org/gitweb.cgi/vlc.git/?a=commit;h=d3b67d8fc36ea550324859846147d376fd387795
---

 modules/video_output/xcb/xvideo.c |    5 ++++-
 1 files changed, 4 insertions(+), 1 deletions(-)

diff --git a/modules/video_output/xcb/xvideo.c b/modules/video_output/xcb/xvideo.c
index 383b7ce..69e6311 100644
--- a/modules/video_output/xcb/xvideo.c
+++ b/modules/video_output/xcb/xvideo.c
@@ -406,9 +406,11 @@ static int Open (vlc_object_t *obj)
 
             xfmt = FindFormat (vd, chroma, &fmt, a->base_id, r, &p_sys->att);
         }
-        free (r);
         if (xfmt == NULL) /* No acceptable image formats */
+        {
+            free (r);
             continue;
+        }
 
         p_sys->id = xfmt->id;
         p_sys->swap_uv = vlc_fourcc_AreUVPlanesSwapped (fmt.i_chroma, chroma);
@@ -420,6 +422,7 @@ static int Open (vlc_object_t *obj)
             fmt.i_gmask = xfmt->green_mask;
             fmt.i_bmask = xfmt->blue_mask;
         }
+        free (r);
 
         /* Grab a port */
         for (unsigned i = 0; i < a->num_ports; i++)