Fix use-after-free in _free_pending_clip()
authorDan Williams <dcbw@redhat.com>
Fri, 7 Mar 2014 15:28:16 +0000 (09:28 -0600)
committerThibault Saunier <thibault.saunier@collabora.com>
Fri, 7 Mar 2014 16:42:52 +0000 (17:42 +0100)
https://bugzilla.gnome.org/show_bug.cgi?id=725855

ges/ges-base-xml-formatter.c

index 5edb89d..3758a78 100644 (file)
@@ -537,7 +537,6 @@ _free_pending_effect (PendingEffects * pend)
 static void
 _free_pending_clip (GESBaseXmlFormatterPrivate * priv, PendingClip * pend)
 {
-  g_free (pend->id);
   gst_object_unref (pend->layer);
   if (pend->properties)
     gst_structure_free (pend->properties);
@@ -545,6 +544,7 @@ _free_pending_clip (GESBaseXmlFormatterPrivate * priv, PendingClip * pend)
   g_list_free_full (pend->pending_bindings,
       (GDestroyNotify) _free_pending_binding);
   g_hash_table_remove (priv->clipid_pendings, pend->id);
+  g_free (pend->id);
   g_slice_free (PendingClip, pend);
 }