From: Philippe Normand <phil at base-art.net>
Date: Mon, 15 Nov 2010 10:49:24 +0000 (+0100)
Subject: buffer: fix memory corruption
X-Git-Tag: RELEASE-0.11.0~560
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=376089db14f0dd74da7936956e7eedc320058d07;p=platform%2Fupstream%2Fgstreamer.git

buffer: fix memory corruption
---

diff --git a/gst/gstbuffer.c b/gst/gstbuffer.c
index e007699..fa2e17f 100644
--- a/gst/gstbuffer.c
+++ b/gst/gstbuffer.c
@@ -289,7 +289,7 @@ _gst_buffer_copy (GstBuffer * buffer)
 static void
 _gst_buffer_free (GstBuffer * buffer)
 {
-  GList *walk;
+  GstBufferMetaItem *walk, *next;
 
   g_return_if_fail (buffer != NULL);
 
@@ -304,8 +304,9 @@ _gst_buffer_free (GstBuffer * buffer)
   if (buffer->parent)
     gst_buffer_unref (buffer->parent);
 
+
   /* free metadata */
-  for (walk = buffer->priv; walk; walk = walk->next) {
+  for (walk = buffer->priv; walk; walk = next) {
     GstBufferMeta *meta = &walk->meta;
     const GstBufferMetaInfo *info = meta->info;
 
@@ -313,7 +314,8 @@ _gst_buffer_free (GstBuffer * buffer)
     if (info->free_func)
       info->free_func (meta, buffer);
     /* and free the slice */
-    g_slice_free1 (ITEM_SIZE (info), meta);
+    next = walk->next;
+    g_slice_free (GstBufferMetaItem, walk);
   }
 
   g_slice_free1 (GST_MINI_OBJECT_SIZE (buffer), buffer);