Attachment 349313 Details for Bug 189462 – Patch

[patch] Patch

bug-189462-20180910185447.patch (text/plain), 3.09 KB, created by Philippe Normand on 2018-09-10 09:54:48 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Philippe Normand

Created: 2018-09-10 09:54:48 PDT

Size: 3.09 KB

patch

obsolete

>Subversion Revision: 235844
>diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
>index 43d342d3c9ff5d0b980c6d90189ac99f80166a71..d79543f03148983764f49cb78845f202d1ccac9e 100644
>--- a/Source/WebCore/ChangeLog
>+++ b/Source/WebCore/ChangeLog
>@@ -1,3 +1,15 @@
>+2018-09-10  Philippe Normand  <pnormand@igalia.com>
>+
>+        [GStreamer] use-after-free in MockVideoCaptureSource
>+        https://bugs.webkit.org/show_bug.cgi?id=189462
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        * platform/mediastream/gstreamer/MockGStreamerVideoCaptureSource.cpp:
>+        (WebCore::WrappedMockRealtimeVideoSource::updateSampleBuffer):
>+        Copy the BGRA data before passing ownership to GStreamer. Also
>+        include a few code style cosmetic changes.
>+
> 2018-09-10  Rob Buis  <rbuis@igalia.com>
> 
>         XMLHttpRequest: overrideMimeType should not update the response's "Content-Type" header
>diff --git a/Source/WebCore/platform/mediastream/gstreamer/MockGStreamerVideoCaptureSource.cpp b/Source/WebCore/platform/mediastream/gstreamer/MockGStreamerVideoCaptureSource.cpp
>index bdfabedd46f8c253eccccbc3f0a1130fe18efbfb..6aea145f71f7385d4411ddb285a547efff77e0ea 100644
>--- a/Source/WebCore/platform/mediastream/gstreamer/MockGStreamerVideoCaptureSource.cpp
>+++ b/Source/WebCore/platform/mediastream/gstreamer/MockGStreamerVideoCaptureSource.cpp
>@@ -40,28 +40,24 @@ public:
> 
>     void updateSampleBuffer()
>     {
>-        int fpsNumerator, fpsDenominator;
>         auto imageBuffer = this->imageBuffer();
>-
>         if (!imageBuffer)
>             return;
> 
>+        int fpsNumerator, fpsDenominator;
>         gst_util_double_to_fraction(frameRate(), &fpsNumerator, &fpsDenominator);
>+        auto imageSize = imageBuffer->internalSize();
>+        auto caps = adoptGRef(gst_caps_new_simple("video/x-raw",
>+            "format", G_TYPE_STRING, "BGRA",
>+            "width", G_TYPE_INT, imageSize.width(),
>+            "height", G_TYPE_INT, imageSize.height(),
>+            "framerate", GST_TYPE_FRACTION, fpsNumerator, fpsDenominator, nullptr));
>         auto data = imageBuffer->toBGRAData();
>         auto size = data.size();
>-        auto image_size = imageBuffer->internalSize();
>-        auto gstsample = gst_sample_new(gst_buffer_new_wrapped(static_cast<guint8*>(data.releaseBuffer().get()), size),
>-            adoptGRef(gst_caps_new_simple("video/x-raw",
>-                "format", G_TYPE_STRING, "BGRA",
>-                "width", G_TYPE_INT, image_size.width(),
>-                "height", G_TYPE_INT, image_size.height(),
>-                "framerate", GST_TYPE_FRACTION, fpsNumerator, fpsDenominator,
>-                nullptr)).get(),
>-            nullptr, nullptr);
>-
>-        auto sample = MediaSampleGStreamer::create(WTFMove(gstsample),
>-            WebCore::FloatSize(), String());
>-        videoSampleAvailable(sample);
>+        auto buffer = adoptGRef(gst_buffer_new_wrapped(g_memdup(data.releaseBuffer().leakPtr(), size), size));
>+        auto gstSample = adoptGRef(gst_sample_new(buffer.get(), caps.get(), nullptr, nullptr));
>+
>+        videoSampleAvailable(MediaSampleGStreamer::create(WTFMove(gstSample), FloatSize(), String()));
>     }
> };
>

Flags:

calvaris: review+

Actions: View | Formatted Diff | Diff

Attachments on bug 189462: 349285 | 349303 | 349313