[vlc-commits] dmo: Fix use after free

[Hugo Beauzée-Luyssen]

vlc/vlc-3.0 | branch: master | Hugo Beauzée-Luyssen <hugo at beauzee.fr> | Tue May 21 13:59:56 2019 +0200| [e326f9a26d4aa5726a85e92f82fc01a5fd3f7c45] | committer: Hugo Beauzée-Luyssen

dmo: Fix use after free

https://hackerone.com/reports/513704

(cherry picked from commit c6b07d7cec3c2684f4bbc702cd1be6f18813f8f2)
Signed-off-by: Hugo Beauzée-Luyssen <hugo at beauzee.fr>

> http://git.videolan.org/gitweb.cgi/vlc/vlc-3.0.git/?a=commit;h=e326f9a26d4aa5726a85e92f82fc01a5fd3f7c45
---

 modules/codec/dmo/dmo.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/codec/dmo/dmo.c b/modules/codec/dmo/dmo.c
index e4d9e90052..5ab1a11c54 100644
--- a/modules/codec/dmo/dmo.c
+++ b/modules/codec/dmo/dmo.c
@@ -868,6 +868,7 @@ static int DecBlock( decoder_t *p_dec, block_t **pp_block )
                        (IMediaBuffer *)p_in, DMO_INPUT_DATA_BUFFERF_SYNCPOINT,
                        0, 0 );
 
+        *pp_block = NULL;
         p_in->vt->Release( (IUnknown *)p_in );
 
         if( i_result == S_FALSE )
@@ -893,7 +894,6 @@ static int DecBlock( decoder_t *p_dec, block_t **pp_block )
 #ifdef DMO_DEBUG
             msg_Dbg( p_dec, "ProcessInput(): successful" );
 #endif
-            *pp_block = NULL;
         }
     }