Attachment 349285 Details for Bug 189462 – Patch

[patch] Patch

bug-189462-20180909114302.patch (text/plain), 3.08 KB, created by Philippe Normand on 2018-09-09 03:43:03 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Philippe Normand

Created: 2018-09-09 03:43:03 PDT

Size: 3.08 KB

patch

obsolete

>Subversion Revision: 235827
>diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
>index dfff4175f9ef5ca37a1147f611d1244cb5c85a80..b70da5cd1f728055fe1a4f52c8116e6240b69412 100644
>--- a/Source/WebCore/ChangeLog
>+++ b/Source/WebCore/ChangeLog
>@@ -1,3 +1,15 @@
>+2018-09-09  Philippe Normand  <pnormand@igalia.com>
>+
>+        [GStreamer] use-after-free in MockVideoCaptureSource
>+        https://bugs.webkit.org/show_bug.cgi?id=189462
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        * platform/mediastream/gstreamer/MockGStreamerVideoCaptureSource.cpp:
>+        (WebCore::WrappedMockRealtimeVideoSource::updateSampleBuffer):
>+        Copy the BGRA data before passing ownership to GStreamer. Also
>+        include a few code style cosmetic changes.
>+
> 2018-09-07  Fujii Hironori  <Hironori.Fujii@sony.com>
> 
>         [Win][Clang] exceptionShouldTerminateProgram of StructuredExceptionHandlerSuppressor.cpp should take DWORD
>diff --git a/Source/WebCore/platform/mediastream/gstreamer/MockGStreamerVideoCaptureSource.cpp b/Source/WebCore/platform/mediastream/gstreamer/MockGStreamerVideoCaptureSource.cpp
>index bdfabedd46f8c253eccccbc3f0a1130fe18efbfb..60e0f23332792f5f31fece641e2f60f5914c4db0 100644
>--- a/Source/WebCore/platform/mediastream/gstreamer/MockGStreamerVideoCaptureSource.cpp
>+++ b/Source/WebCore/platform/mediastream/gstreamer/MockGStreamerVideoCaptureSource.cpp
>@@ -40,28 +40,24 @@ public:
> 
>     void updateSampleBuffer()
>     {
>-        int fpsNumerator, fpsDenominator;
>         auto imageBuffer = this->imageBuffer();
>-
>         if (!imageBuffer)
>             return;
> 
>+        int fpsNumerator, fpsDenominator;
>         gst_util_double_to_fraction(frameRate(), &fpsNumerator, &fpsDenominator);
>         auto data = imageBuffer->toBGRAData();
>         auto size = data.size();
>-        auto image_size = imageBuffer->internalSize();
>-        auto gstsample = gst_sample_new(gst_buffer_new_wrapped(static_cast<guint8*>(data.releaseBuffer().get()), size),
>-            adoptGRef(gst_caps_new_simple("video/x-raw",
>-                "format", G_TYPE_STRING, "BGRA",
>-                "width", G_TYPE_INT, image_size.width(),
>-                "height", G_TYPE_INT, image_size.height(),
>-                "framerate", GST_TYPE_FRACTION, fpsNumerator, fpsDenominator,
>-                nullptr)).get(),
>-            nullptr, nullptr);
>-
>-        auto sample = MediaSampleGStreamer::create(WTFMove(gstsample),
>-            WebCore::FloatSize(), String());
>-        videoSampleAvailable(sample);
>+        auto imageSize = imageBuffer->internalSize();
>+        auto caps = adoptGRef(gst_caps_new_simple("video/x-raw",
>+            "format", G_TYPE_STRING, "BGRA",
>+            "width", G_TYPE_INT, imageSize.width(),
>+            "height", G_TYPE_INT, imageSize.height(),
>+            "framerate", GST_TYPE_FRACTION, fpsNumerator, fpsDenominator, nullptr));
>+        auto gstSample = adoptGRef(gst_sample_new(gst_buffer_new_wrapped(g_memdup(data.data(), size),
>+            size), caps.get(), nullptr, nullptr));
>+
>+        videoSampleAvailable(MediaSampleGStreamer::create(WTFMove(gstSample), WebCore::FloatSize(), String()));
>     }
> };
>

Actions: View | Formatted Diff | Diff

Attachments on bug 189462: 349285 | 349303 | 349313