[vlc-devel] Double freeing in metadata parsing

[ogg.k.ogg.k at googlemail.com]

Hi,

I'm getting double freeing, in parsing metadata from an Ogg stream.
I've tracked it down to:
vorbis_ParseComment calling vlc_meta_AddExtra.
vlc_meta_AddExtra freeing any old value for the given key.
vlc_meta_AddExtra removing values for that key, passing vlc_meta_FreeExtraKey.
vlc_dictionary_remove_value_for_key calling the passed
vlc_meta_FreeExtraKey on the value.
vlc_meta_FreeExtraKey freeing the value - which was just freed.

Now, there are two suspicious things:
1 - vlc_meta_FreeExtraKey is passed and ends up freeing a value, *not* a key:
that's either a bug, or naming being confusing
2 - vlc_dictionary_remove_value_for_key calling (from what I see) that pf_free
function on all values, not for all "extra" ones (eg, after the first
one ?), though
the passed function's name suggests that the main one should not be freed
(there might be subtleties with the dictionary code that cause that
first one not
to be freed, I don't know that code enough to tell).

Anyway, just commenting out the freeing of the old value before removing it
from the dictionary (see patch below) fixes the problem, but might leak
somewhere else - again, I do not know enough this code to be sure. So if
someone who actually knows this code could check, it would be grand.

Cheers

diff --git a/include/vlc_meta.h b/include/vlc_meta.h
index b5fc8c3..815e269 100644
--- a/include/vlc_meta.h
+++ b/include/vlc_meta.h
@@ -136,7 +136,7 @@ static inline void vlc_meta_AddExtra( vlc_meta_t
*m, const char *psz_name, const
     char *psz_oldvalue = (char *)vlc_dictionary_value_for_key(
&m->extra_tags, psz_name );
     if( psz_oldvalue != kVLCDictionaryNotFound )
     {
-        free( psz_oldvalue );
+        //free( psz_oldvalue );
         vlc_dictionary_remove_value_for_key( &m->extra_tags, psz_name,
                                              vlc_meta_FreeExtraKey, NULL );
     }