[vlc-commits] vout: fix potential use-after-free

[Rémi Denis-Courmont]

vlc | branch: master | Rémi Denis-Courmont <remi at remlab.net> | Sat Jan 26 12:18:24 2019 +0200| [f61c6d81acbd044b7030c37eb263eb12db510282] | committer: Rémi Denis-Courmont

vout: fix potential use-after-free

> http://git.videolan.org/gitweb.cgi/vlc.git/?a=commit;h=f61c6d81acbd044b7030c37eb263eb12db510282
---

 src/video_output/video_output.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/src/video_output/video_output.c b/src/video_output/video_output.c
index da9e82bd73..6de2c50d5f 100644
--- a/src/video_output/video_output.c
+++ b/src/video_output/video_output.c
@@ -331,6 +331,9 @@ vout_thread_t *vout_Request(vlc_object_t *object,
         vout = VoutCreate(object, cfg);
         if (vout == NULL)
             return NULL;
+
+        if (input != NULL)
+            vout->p->input = vlc_object_hold((vlc_object_t *)input);
     }
 
     vout_control_WaitEmpty(&vout->p->control);
@@ -342,7 +345,6 @@ vout_thread_t *vout_Request(vlc_object_t *object,
 
     if (input != NULL)
         spu_Attach(vout->p->spu, input);
-    vout->p->input = input;
     vout_IntfReinit(vout);
     return vout;
 }
@@ -406,7 +408,8 @@ static void VoutDestructor(vlc_object_t *object)
 
     /* */
     vout_snapshot_Destroy(vout->p->snapshot);
-
+    if (vout->p->input != NULL)
+        vlc_object_release((vlc_object_t *)vout->p->input);
     video_format_Clean(&vout->p->original);
 }