[vlc-devel] [vlc-commits] ml: fix double free.

[Rémi Denis-Courmont]

Le jeudi 19 juillet 2012 15:23:25 Francois Cartegnie, vous avez écrit :
> vlc | branch: master | Francois Cartegnie <fcvlcdev at free.fr> | Thu Jul 19
> 13:53:23 2012 +0200| [bc88ea7a81030c681ae68e86f452d3aa8bcf8d22] |
> committer: Francois Cartegnie
> 
> ml: fix double free.
> 
> Double free was occuring on some psz_url when copying medias.
> Might be caused by a double listing from the sql query.
> 
> > http://git.videolan.org/gitweb.cgi/vlc.git/?a=commit;h=bc88ea7a81030c681a
> > e68e86f452d3aa8bcf8d22
> 
> ---
> 
>  include/vlc_media_library.h |   45
> ++++++++++++++++++++++--------------------- 1 file changed, 23
> insertions(+), 22 deletions(-)
> 
> diff --git a/include/vlc_media_library.h b/include/vlc_media_library.h
> index 2529dd5..313f8a3 100644
> --- a/include/vlc_media_library.h
> +++ b/include/vlc_media_library.h
> @@ -558,8 +558,8 @@ static inline void ml_FreePeople( ml_person_t *p_person
> ) if( p_person == NULL )
>          return;
>      ml_FreePeople( p_person->p_next );
> -    free( p_person->psz_name );
> -    free( p_person->psz_role );
> +    FREENULL( p_person->psz_name );
> +    FREENULL( p_person->psz_role );
>      free( p_person );
>  }

This chunk cannot possibly be correct.

> 
> @@ -570,16 +570,16 @@ static inline void ml_FreePeople( ml_person_t
> *p_person ) */
>  static inline void ml_FreeMediaContent( ml_media_t *p_media )
>  {
> -    free( p_media->psz_uri );
> -    free( p_media->psz_title );
> -    free( p_media->psz_orig_title );
> -    free( p_media->psz_cover );
> -    free( p_media->psz_comment );
> -    free( p_media->psz_extra );
> -    free( p_media->psz_genre );
> -    free( p_media->psz_album );
> -    free( p_media->psz_preview );
> -    free( p_media->psz_language );
> +    FREENULL( p_media->psz_uri );
> +    FREENULL( p_media->psz_title );
> +    FREENULL( p_media->psz_orig_title );
> +    FREENULL( p_media->psz_cover );
> +    FREENULL( p_media->psz_comment );
> +    FREENULL( p_media->psz_extra );
> +    FREENULL( p_media->psz_genre );
> +    FREENULL( p_media->psz_album );
> +    FREENULL( p_media->psz_preview );
> +    FREENULL( p_media->psz_language );
>      ml_FreePeople( p_media->p_people );
>      p_media->b_sparse = true;
>      p_media->i_id = 0;
> @@ -721,37 +721,38 @@ static inline int ml_CopyMedia( ml_media_t *b,
> ml_media_t *a ) b->i_bitrate = a->i_bitrate;
>      b->i_samplerate = a->i_samplerate;
>      b->i_bpm = a->i_bpm;
> -    free( b->psz_uri );
> +    FREENULL( b->psz_uri );
>      if( a->psz_uri )
>          b->psz_uri = strdup( a->psz_uri );
> -    free( b->psz_title );
> +    FREENULL( b->psz_title );
>      if( a->psz_title )
>          b->psz_title = strdup( a->psz_title );
> -    free( b->psz_orig_title );
> +    FREENULL( b->psz_orig_title );
>      if( a->psz_orig_title )
>          b->psz_orig_title = strdup( a->psz_orig_title );
> -    free( b->psz_album );
> +    FREENULL( b->psz_album );
>      if( a->psz_album )
>          b->psz_album = strdup( a->psz_album );
> -    free( b->psz_cover );
> +    FREENULL( b->psz_cover );
>      if( a->psz_cover )
>          b->psz_cover = strdup( a->psz_cover );
> -    free( b->psz_genre );
> +    FREENULL( b->psz_genre );
>      if( a->psz_genre )
>          b->psz_genre = strdup( a->psz_genre );
> -    free( b->psz_comment );
> +    FREENULL( b->psz_comment );
>      if( a->psz_comment )
>          b->psz_comment = strdup( a->psz_comment );
> -    free( b->psz_extra );
> +    FREENULL( b->psz_extra );
>      if( a->psz_extra )
>          b->psz_extra = strdup( a->psz_extra );
> -    free( b->psz_preview );
> +    FREENULL( b->psz_preview );
>      if( a->psz_preview )
>          b->psz_preview = strdup( a->psz_preview );
> -    free( b->psz_language );
> +    FREENULL( b->psz_language );
>      if( a->psz_language )
>          b->psz_language = strdup( a->psz_language );
>      ml_FreePeople( b->p_people );
> +    b->p_people = NULL;

This chunk is redundant and thus wrong.

>      if( a->p_people )        ml_CopyPersons( &( b->p_people ), a->p_people
> ); ml_UnlockMedia( b );
>      ml_UnlockMedia( a );
> 
> _______________________________________________
> vlc-commits mailing list
> vlc-commits at videolan.org
> http://mailman.videolan.org/listinfo/vlc-commits


-- 
Rémi Denis-Courmont
http://www.remlab.net/
http://fi.linkedin.com/in/remidenis