[vlc-commits] lib: media: Hold the media during the preparsing

[Hugo Beauzée-Luyssen]

vlc | branch: master | Hugo Beauzée-Luyssen <hugo at beauzee.fr> | Fri Nov 13 13:50:39 2020 +0100| [a708c988091d6bc770212f5deeaba45e2395f4b2] | committer: Hugo Beauzée-Luyssen

lib: media: Hold the media during the preparsing

This prevents a potential use after free if the caller releases the
media before the preparsing is complete, or if the media is immediatly
released after the preparsing completes since
a4a94bb3f942989302d0aebc22f3de8ad897a8ff

> http://git.videolan.org/gitweb.cgi/vlc.git/?a=commit;h=a708c988091d6bc770212f5deeaba45e2395f4b2
---

 lib/media.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/lib/media.c b/lib/media.c
index 7ab98de7c1..346809f93b 100644
--- a/lib/media.c
+++ b/lib/media.c
@@ -404,6 +404,7 @@ static void input_item_preparse_ended(input_item_t *item,
             return;
     }
     send_parsed_changed( p_md, new_status );
+    libvlc_media_release( p_md );
 }
 
 /**
@@ -835,11 +836,15 @@ static int media_parse(libvlc_media_t *media, bool b_async,
         if (parse_flag & libvlc_media_do_interact)
             parse_scope |= META_REQUEST_OPTION_DO_INTERACT;
 
+        libvlc_media_retain(media);
         ret = libvlc_MetadataRequest(libvlc, item, parse_scope,
                                      &input_preparser_callbacks, media,
                                      timeout, media);
         if (ret != VLC_SUCCESS)
+        {
+            libvlc_media_release(media);
             return ret;
+        }
     }
     else
         return VLC_EGENERIC;