diff options
author | Olivier CrĂȘte <olivier.crete@collabora.co.uk> | 2010-04-07 19:05:37 -0400 |
---|---|---|
committer | Olivier CrĂȘte <olivier.crete@collabora.co.uk> | 2010-06-03 15:27:43 -0400 |
commit | b9decbb0568de0df5e531783540935102e911e14 (patch) | |
tree | 9201b52175950c93877224a81c81b2ca25a842d5 /gst/shm | |
parent | e8b4310aa6162b83c6193dfad98dc56ec022198f (diff) |
shmpipe: Fix crash when sp_close_shm is called with self == NULL.
If sp_open_shm errors out trying to open a shm area, it would crash
when trying to free the area. The RETURN_ERROR macro calls
sp_shm_area_dec with self == NULL. sp_shm_area_dec calls
sp_shm_close, with self == NULL, which it then tries to access a
parameter of without checking. This patch checks to make sure
self != NULL before accessing that parameter.
Diffstat (limited to 'gst/shm')
-rw-r--r-- | gst/shm/shmpipe.c | 25 |
1 files changed, 13 insertions, 12 deletions
diff --git a/gst/shm/shmpipe.c b/gst/shm/shmpipe.c index 497e1acc5..169600cd7 100644 --- a/gst/shm/shmpipe.c +++ b/gst/shm/shmpipe.c @@ -297,26 +297,27 @@ sp_open_shm (char *path, int id, int writer, mode_t perms, size_t size) static void sp_close_shm (ShmPipe * self, ShmArea * area) { - ShmArea *item = NULL; - ShmArea *prev_item = NULL; - assert (area->use_count == 0); if (area->allocspace) shm_alloc_space_free (area->allocspace); + if (self != NULL) { + ShmArea *item = NULL; + ShmArea *prev_item = NULL; - for (item = self->shm_area; item; item = item->next) { - if (item == area) { - if (prev_item) - prev_item->next = item->next; - else - self->shm_area = item->next; - break; + for (item = self->shm_area; item; item = item->next) { + if (item == area) { + if (prev_item) + prev_item->next = item->next; + else + self->shm_area = item->next; + break; + } + prev_item = item; } - prev_item = item; + assert (item); } - assert (item); if (area->shm_area != MAP_FAILED) munmap (area->shm_area, area->shm_area_len); |