[vlc-commits] input: hold renderer_item when passing control

[Thomas Guillem]

vlc | branch: master | Thomas Guillem <thomas at gllm.fr> | Fri Dec  1 11:25:57 2017 +0100| [af123cc25b37976c34b2e342082493fc8405f4d6] | committer: Thomas Guillem

input: hold renderer_item when passing control

This fix an invalid-read if more than one renderer items are passed in a row.

> http://git.videolan.org/gitweb.cgi/vlc.git/?a=commit;h=af123cc25b37976c34b2e342082493fc8405f4d6
---

 src/input/control.c | 3 ++-
 src/input/input.c   | 4 ++++
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/src/input/control.c b/src/input/control.c
index 5793e8cfbd..75a2f64355 100644
--- a/src/input/control.c
+++ b/src/input/control.c
@@ -27,6 +27,7 @@
 
 #include <vlc_common.h>
 #include <vlc_memstream.h>
+#include <vlc_renderer_discovery.h>
 
 #include <stdio.h>
 #include <stdlib.h>
@@ -576,7 +577,7 @@ int input_vaControl( input_thread_t *p_input, int i_query, va_list args )
         case INPUT_SET_RENDERER:
         {
             vlc_renderer_item_t* p_item = va_arg( args, vlc_renderer_item_t* );
-            val.p_address = p_item;
+            val.p_address = p_item ? vlc_renderer_item_hold( p_item ) : NULL;
             input_ControlPush( p_input, INPUT_CONTROL_SET_RENDERER, &val );
             return VLC_SUCCESS;
         }
diff --git a/src/input/input.c b/src/input/input.c
index 5537501248..af572049e6 100644
--- a/src/input/input.c
+++ b/src/input/input.c
@@ -1711,6 +1711,10 @@ static void ControlRelease( int i_type, vlc_value_t val )
     case INPUT_CONTROL_UPDATE_VIEWPOINT:
         free( val.p_address );
         break;
+    case INPUT_CONTROL_SET_RENDERER:
+        if( val.p_address )
+            vlc_renderer_item_release( val.p_address );
+        break;
 
     default:
         break;