[gstreamer-bugs] [Bug 376594] id3demux crashes when reading compressed ID3 frames

[GStreamer (bugzilla.gnome.org)]

Do not reply to this via email (we are currently unable to handle email
responses and they get discarded).  You can add comments to this bug at
http://bugzilla.gnome.org/show_bug.cgi?id=376594

  GStreamer | gst-plugins-good | Ver: 0.10.x





------- Comment #3 from René Stadler  2006-11-18 21:06 UTC -------
Created an attachment (id=76816)
 --> (http://bugzilla.gnome.org/attachment.cgi?id=76816&action=view)
Properly parse compressed frames

The problem is in id3v2frames.c, id3demux_id3v2_parse_frame: For compressed
frame data, work->parse_data is set to newly allocated memory that is filled
with the uncompressed data.  Then the appropriate parse_* function is called,
some of which advance the work->parse_data pointer as they do the parsing. 
This is followed by g_free (work->parse_data), which crashes in this case.

This fix attempt implements these changes:

        * gst/id3demux/id3v2frames.c: (id3demux_id3v2_parse_frame):
          Make sure that g_free always gets called on the same pointer that was 
          returned by g_malloc.  Fixes #376594.
          Do not leak memory if decompressed size is wrong.
          Remove unneeded check of return value of g_malloc.


-- 
Configure bugmail: http://bugzilla.gnome.org/userprefs.cgi?tab=email