From: minje.ahn <minje.ahn@samsung.com>
Date: Thu, 18 Aug 2022 02:47:16 +0000 (+0900)
Subject: Rollback removePicture in ogg
X-Git-Tag: submit/tizen/20220818.080154~1
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=28c12b14401a87bddaa34ca1e9230e9e4f061764;p=platform%2Fcore%2Fapi%2Fmetadata-editor.git

Rollback removePicture in ogg

Change-Id: I29a04e6eca68b02bb038014199e41f500e826e1b
Signed-off-by: minje.ahn <minje.ahn@samsung.com>
---

diff --git a/src/metadata_editor.cpp b/src/metadata_editor.cpp
index 17d7c17..79107b2 100755
--- a/src/metadata_editor.cpp
+++ b/src/metadata_editor.cpp
@@ -176,7 +176,14 @@ static int __remove_ogg_picture(Ogg::XiphComment *xtag, int index)
 	ME_RETVM_IF(!xtag, METADATA_EDITOR_ERROR_INVALID_PARAMETER, "Invalid XiphComment");
 	ME_RETV_IF(!__is_valid_index(xtag->pictureList(), index), METADATA_EDITOR_ERROR_INVALID_PARAMETER);
 
-	auto it = std::next(xtag->pictureList().begin(), index);
+	/* xiphComment::removePicture works abnormally. Do not modify this fuction.
+		- Use xtag->pictureList()[index] : crashed
+		- Use copied xtag->pictureList()[index] : crashed
+		- Use iterator with std::next() : heap-use-after-free occured
+	*/
+	List<FLAC::Picture *>::Iterator it = xtag->pictureList().begin();
+	std::advance(it, index);
+
 	/* No need to set it to 'true'. taglib sets auto-delete. */
 	xtag->removePicture(*it, false);