Ticket #5135: libs_libmythtv_atscstreamdata.cpp-avoid-use-after-free.patch

File libs_libmythtv_atscstreamdata.cpp-avoid-use-after-free.patch, 1.7 KB (added by Erik Hovland <erik@…>, 13 years ago)

defer deleting psip until after it is used for the last time

  • libs/libmythtv/mpeg/atscstreamdata.cpp

    psip could be used to look into a map after it has been freed.
    
    From: Erik Hovland <erik@hovland.org>
    
    It really shouldn't be at that point.
    ---
    
     libs/libmythtv/mpeg/atscstreamdata.cpp |   15 ++++++++++++---
     1 files changed, 12 insertions(+), 3 deletions(-)
    
    diff --git a/libs/libmythtv/mpeg/atscstreamdata.cpp b/libs/libmythtv/mpeg/atscstreamdata.cpp
    index 084ea35..5cc3882 100644
    a b void ATSCStreamData::DeleteCachedTable(PSIPTable *psip) const 
    726726    if (!psip)
    727727        return;
    728728
     729    bool delete_psip = false;
     730
    729731    QMutexLocker locker(&_cache_lock);
    730732    if (_cached_ref_cnt[psip] > 0)
    731733    {
    void ATSCStreamData::DeleteCachedTable(PSIPTable *psip) const 
    736738    {
    737739        if (psip == _cached_mgt)
    738740            _cached_mgt = NULL;
    739         delete psip;
     741
     742        delete_psip = true;
    740743    }
    741744    else if ((TableID::TVCT == psip->TableID()) &&
    742745             _cached_tvcts[psip->tsheader()->PID()])
    743746    {
    744747        _cached_tvcts[psip->tsheader()->PID()] = NULL;
    745         delete psip;
     748        delete_psip = true;
    746749    }
    747750    else if ((TableID::CVCT == psip->TableID()) &&
    748751             _cached_cvcts[psip->tsheader()->PID()])
    749752    {
    750753        _cached_cvcts[psip->tsheader()->PID()] = NULL;
    751         delete psip;
     754        delete_psip = true;
    752755    }
    753756    else
    754757    {
    void ATSCStreamData::DeleteCachedTable(PSIPTable *psip) const 
    759762    it = _cached_slated_for_deletion.find(psip);
    760763    if (it != _cached_slated_for_deletion.end())
    761764        _cached_slated_for_deletion.erase(it);
     765
     766    if (delete_psip)
     767    {
     768        delete(psip);
     769        psip = NULL;
     770    }
    762771}
    763772
    764773void ATSCStreamData::ReturnCachedTVCTTables(tvct_vec_t &tvcts) const