playbin: Fix wrong AV element pair selection when rank is very large value

If user set very high rank to an element (e.g., integer max),
integer overflow can happen while multiplication operation

Part-of: <https://gitlab.freedesktop.org/gstreamer/gst-plugins-base/-/merge_requests/690>

diff --git a/gst/playback/gstplaybin2.c b/gst/playback/gstplaybin2.c
index e8aedcf9004956831907dfa075269ffd7c77307d..a8d719f2285d97c1c63221bb4108c0ff1895c818 100644 (file)
--- a/gst/playback/gstplaybin2.c
+++ b/gst/playback/gstplaybin2.c
@@ -4023,10 +4023,10 @@ avelement_compare (gconstpointer p1, gconstpointer p2)
   if (v1->sink && v2->sink) {
     fs1 = (GstPluginFeature *) v1->sink;
     fs2 = (GstPluginFeature *) v2->sink;
-    v1_rank =
-        gst_plugin_feature_get_rank (fd1) * gst_plugin_feature_get_rank (fs1);
-    v2_rank =
-        gst_plugin_feature_get_rank (fd2) * gst_plugin_feature_get_rank (fs2);
+    v1_rank = (gint64) gst_plugin_feature_get_rank (fd1) *
+        gst_plugin_feature_get_rank (fs1);
+    v2_rank = (gint64) gst_plugin_feature_get_rank (fd2) *
+        gst_plugin_feature_get_rank (fs2);
   } else {
     v1_rank = gst_plugin_feature_get_rank (fd1);
     v2_rank = gst_plugin_feature_get_rank (fd2);

diff --git a/gst/playback/gstplaybin3.c b/gst/playback/gstplaybin3.c
index 3c8e2d5ec9fb92f3da596ebf3dd8e059046f582b..8c76e863529b0655f9fb72c0850065c3075ee108 100644 (file)
--- a/gst/playback/gstplaybin3.c
+++ b/gst/playback/gstplaybin3.c
@@ -3348,10 +3348,10 @@ avelement_compare (gconstpointer p1, gconstpointer p2)
   if (v1->sink && v2->sink) {
     fs1 = (GstPluginFeature *) v1->sink;
     fs2 = (GstPluginFeature *) v2->sink;
-    v1_rank =
-        gst_plugin_feature_get_rank (fd1) * gst_plugin_feature_get_rank (fs1);
-    v2_rank =
-        gst_plugin_feature_get_rank (fd2) * gst_plugin_feature_get_rank (fs2);
+    v1_rank = (gint64) gst_plugin_feature_get_rank (fd1) *
+        gst_plugin_feature_get_rank (fs1);
+    v2_rank = (gint64) gst_plugin_feature_get_rank (fd2) *
+        gst_plugin_feature_get_rank (fs2);
   } else {
     v1_rank = gst_plugin_feature_get_rank (fd1);
     v2_rank = gst_plugin_feature_get_rank (fd2);