srtp: zero out session member on dealloc

Fixes a user-after-free retrieving stats from _get_property()

diff --git a/ext/srtp/gstsrtpdec.c b/ext/srtp/gstsrtpdec.c
index e1be70e0a29594e68ed98b87509fea761a3e9097..4ad989fb29c668b2ae6cf942adbac38a636e924e 100644 (file)
--- a/ext/srtp/gstsrtpdec.c
+++ b/ext/srtp/gstsrtpdec.c
@@ -777,8 +777,10 @@ gst_srtp_dec_clear_streams (GstSrtpDec * filter)
 
   GST_OBJECT_LOCK (filter);
 
-  if (!filter->first_session)
+  if (!filter->first_session) {
     srtp_dealloc (filter->session);
+    filter->session = NULL;
+  }
 
   if (filter->streams)
     nb = g_hash_table_foreach_remove (filter->streams, remove_yes, NULL);

diff --git a/ext/srtp/gstsrtpenc.c b/ext/srtp/gstsrtpenc.c
index ff17fd03f7e38cda27d90cbbe9f40b48f4ba03b5..893ece8be3216b9a20add7f8691cdf7325334f0e 100644 (file)
--- a/ext/srtp/gstsrtpenc.c
+++ b/ext/srtp/gstsrtpenc.c
@@ -447,8 +447,10 @@ gst_srtp_enc_create_session (GstSrtpEnc * filter)
 static void
 gst_srtp_enc_reset_no_lock (GstSrtpEnc * filter)
 {
-  if (!filter->first_session)
+  if (!filter->first_session) {
     srtp_dealloc (filter->session);
+    filter->session = NULL;
+  }
 
   filter->first_session = TRUE;
   filter->key_changed = FALSE;