fdkaacenc: fix accessing freed memory

The buffer data is not always copied in _Fill, and will be
read in _DecodeFrame. We unmap at the end of the function,
whether we get there via failure or early out, and keep a
ref to the buffer to ensure we can use it to unmap the
memory even after _finish_frame is called, as it unrefs
the buffer.

Note that there is an access beyond the allocated buffer,
which is only apparent when playing from souphttpsrc (ie,
not from filesrc). This appears to be a bug in the bit
reading code in libfdkaac AFAICT.

https://bugzilla.gnome.org/show_bug.cgi?id=772186

diff --git a/ext/fdkaac/gstfdkaacdec.c b/ext/fdkaac/gstfdkaacdec.c
index c903d27af2731a1b2b844996b129fb9c8531966d..c271837526fc70488bcfc6c7f68f9392f18f651d 100644 (file)
--- a/ext/fdkaac/gstfdkaacdec.c
+++ b/ext/fdkaac/gstfdkaacdec.c
@@ -190,6 +190,7 @@ gst_fdkaacdec_handle_frame (GstAudioDecoder * dec, GstBuffer * inbuf)
   gboolean need_reorder;
 
   if (inbuf) {
+    gst_buffer_ref (inbuf);
     gst_buffer_map (inbuf, &imap, GST_MAP_READ);
     valid = size = imap.size;
 
@@ -198,10 +199,8 @@ gst_fdkaacdec_handle_frame (GstAudioDecoder * dec, GstBuffer * inbuf)
                 &valid)) != AAC_DEC_OK) {
       GST_AUDIO_DECODER_ERROR (self, 1, STREAM, DECODE, (NULL),
           ("filling error: %d", err), ret);
-      gst_buffer_unmap (inbuf, &imap);
       goto out;
     }
-    gst_buffer_unmap (inbuf, &imap);
 
     if (GST_BUFFER_IS_DISCONT (inbuf))
       flags |= AACDEC_INTR;
@@ -395,6 +394,11 @@ finish:
 
 out:
 
+  if (inbuf) {
+    gst_buffer_unmap (inbuf, &imap);
+    gst_buffer_unref (inbuf);
+  }
+
   return ret;
 }