srtp: zero out session member on dealloc

Fixes a user-after-free retrieving stats from _get_property()

diff --git a/ext/srtp/gstsrtpdec.c b/ext/srtp/gstsrtpdec.c
index e1be70e..4ad989f 100644 (file)
--- a/ext/srtp/gstsrtpdec.c
+++ b/ext/srtp/gstsrtpdec.c
@@ -777,8 +777,10 @@ gst_srtp_dec_clear_streams (GstSrtpDec * filter)
 
   GST_OBJECT_LOCK (filter);
 
-  if (!filter->first_session)
+  if (!filter->first_session) {
     srtp_dealloc (filter->session);
+    filter->session = NULL;
+  }
 
   if (filter->streams)
     nb = g_hash_table_foreach_remove (filter->streams, remove_yes, NULL);

diff --git a/ext/srtp/gstsrtpenc.c b/ext/srtp/gstsrtpenc.c
index ff17fd0..893ece8 100644 (file)
--- a/ext/srtp/gstsrtpenc.c
+++ b/ext/srtp/gstsrtpenc.c
@@ -447,8 +447,10 @@ gst_srtp_enc_create_session (GstSrtpEnc * filter)
 static void
 gst_srtp_enc_reset_no_lock (GstSrtpEnc * filter)
 {
-  if (!filter->first_session)
+  if (!filter->first_session) {
     srtp_dealloc (filter->session);
+    filter->session = NULL;
+  }
 
   filter->first_session = TRUE;
   filter->key_changed = FALSE;