[vlc-commits] decoder: lock when writing p_owner->fmt from Sout

[Thomas Guillem]

vlc | branch: master | Thomas Guillem <thomas at gllm.fr> | Fri Dec 15 16:40:16 2017 +0100| [000910a091023b29e68065b36769842db36d93c5] | committer: Thomas Guillem

decoder: lock when writing p_owner->fmt from Sout

This fixes an UB (that can lead to a heap-use-after-free) when
input_DecoderHasFormatChanged() is called while modifying the fmt from
DecoderProcessSout().

> http://git.videolan.org/gitweb.cgi/vlc.git/?a=commit;h=000910a091023b29e68065b36769842db36d93c5
---

 src/input/decoder.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/input/decoder.c b/src/input/decoder.c
index f5dbbe6d61..a34e9fb44f 100644
--- a/src/input/decoder.c
+++ b/src/input/decoder.c
@@ -851,7 +851,6 @@ static void DecoderProcessSout( decoder_t *p_dec, block_t *p_block )
         {
             vlc_mutex_lock( &p_owner->lock );
             DecoderUpdateFormatLocked( p_dec );
-            vlc_mutex_unlock( &p_owner->lock );
 
             p_owner->fmt.i_group = p_dec->fmt_in.i_group;
             p_owner->fmt.i_id = p_dec->fmt_in.i_id;
@@ -861,6 +860,7 @@ static void DecoderProcessSout( decoder_t *p_dec, block_t *p_block )
                 p_owner->fmt.psz_language =
                     strdup( p_dec->fmt_in.psz_language );
             }
+            vlc_mutex_unlock( &p_owner->lock );
 
             p_owner->p_sout_input =
                 sout_InputNew( p_owner->p_sout, &p_owner->fmt );