Commit 39ed0e0d authored by Rafaël Carré's avatar Rafaël Carré

Fix double free if there are several message queues - CID 135

parent ab9eb7bf
...@@ -210,6 +210,8 @@ void __msg_Unsubscribe( vlc_object_t *p_this, msg_subscription_t *p_sub ) ...@@ -210,6 +210,8 @@ void __msg_Unsubscribe( vlc_object_t *p_this, msg_subscription_t *p_sub )
msg_bank_t *p_bank = &p_this->p_libvlc->msg_bank; msg_bank_t *p_bank = &p_this->p_libvlc->msg_bank;
int i,j; int i,j;
free( p_sub ); /* we won't dereference the pointer */
vlc_mutex_lock( &p_bank->lock ); vlc_mutex_lock( &p_bank->lock );
for( i = 0 ; i< p_bank->i_queues ; i++ ) for( i = 0 ; i< p_bank->i_queues ; i++ )
...@@ -222,7 +224,6 @@ void __msg_Unsubscribe( vlc_object_t *p_this, msg_subscription_t *p_sub ) ...@@ -222,7 +224,6 @@ void __msg_Unsubscribe( vlc_object_t *p_this, msg_subscription_t *p_sub )
REMOVE_ELEM( p_bank->pp_queues[i]->pp_sub, REMOVE_ELEM( p_bank->pp_queues[i]->pp_sub,
p_bank->pp_queues[i]->i_sub, p_bank->pp_queues[i]->i_sub,
j ); j );
if( p_sub ) free( p_sub );
} }
} }
vlc_mutex_unlock( & p_bank->pp_queues[i]->lock ); vlc_mutex_unlock( & p_bank->pp_queues[i]->lock );
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment