[vlc-devel] [vlc-commits] upnp: fix deadlock when calling UpnpFinish locked

[Rémi Denis-Courmont]

Le 2016-02-08 17:02, git at videolan.org a écrit :
> vlc | branch: master | Thomas Guillem <thomas at gllm.fr> | Wed Feb  3
> 13:19:44 2016 +0100| [7e11257c2823417b582f4e4ad3108dce7c4c372e] |
> committer: Thomas Guillem
>
> upnp: fix deadlock when calling UpnpFinish locked
>
>> 
>> http://git.videolan.org/gitweb.cgi/vlc.git/?a=commit;h=7e11257c2823417b582f4e4ad3108dce7c4c372e
> ---
>
>  modules/services_discovery/upnp.cpp |   16 +++++++++++++++-
>  modules/services_discovery/upnp.hpp |    1 +
>  2 files changed, 16 insertions(+), 1 deletion(-)
>
> diff --git a/modules/services_discovery/upnp.cpp
> b/modules/services_discovery/upnp.cpp
> index f7bfb4f..99988dd 100644
> --- a/modules/services_discovery/upnp.cpp
> +++ b/modules/services_discovery/upnp.cpp
> @@ -73,6 +73,7 @@ struct access_sys_t
>
>  UpnpInstanceWrapper* UpnpInstanceWrapper::s_instance;
>  vlc_mutex_t UpnpInstanceWrapper::s_lock = VLC_STATIC_MUTEX;
> +vlc_cond_t UpnpInstanceWrapper::s_cond = VLC_STATIC_COND;
>
>  /*
>   * VLC callback prototypes
> @@ -1060,6 +1061,12 @@ UpnpInstanceWrapper::~UpnpInstanceWrapper()
>  UpnpInstanceWrapper *UpnpInstanceWrapper::get(vlc_object_t *p_obj,
> Upnp_FunPtr callback, SD::MediaServerList *opaque)
>  {
>      vlc_mutex_locker lock( &s_lock );
> +
> +    /* refcount is 0 but instance is not NULL, UpnpFinish is being 
> called so
> +     * wait for it to finish */
> +    while ( s_instance != NULL && s_instance->refcount_ == 0 )

Readubg refcount_ here is use after free^Wdelete.

-- 
Rémi Denis-Courmont
http://www.remlab.net/