From 8c44361bca80fa4ed2ec6005c624343c7f4ec866 Mon Sep 17 00:00:00 2001 From: Debarshi Ray Date: Fri, 2 Nov 2012 16:39:28 +0100 Subject: [PATCH] speexdec: Don't unmap or finish_frame an invalid GstBuffer https://bugzilla.gnome.org/show_bug.cgi?id=687464 --- ext/speex/gstspeexdec.c | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/ext/speex/gstspeexdec.c b/ext/speex/gstspeexdec.c index 234abe6..8f9da2a 100644 --- a/ext/speex/gstspeexdec.c +++ b/ext/speex/gstspeexdec.c @@ -392,6 +392,7 @@ gst_speex_dec_parse_data (GstSpeexDec * dec, GstBuffer * buf) /* now decode each frame, catering for unknown number of them (e.g. rtp) */ for (i = 0; i < fpp; i++) { GstBuffer *outbuf; + gboolean corrupted = FALSE; gint ret; GST_LOG_OBJECT (dec, "decoding frame %d/%d, %d bits remaining", i, fpp, @@ -425,18 +426,15 @@ gst_speex_dec_parse_data (GstSpeexDec * dec, GstBuffer * buf) } else { GST_WARNING_OBJECT (dec, "Unexpected end of stream found"); } - gst_audio_decoder_finish_frame (GST_AUDIO_DECODER (dec), NULL, 1); - gst_buffer_unref (outbuf); + corrupted = TRUE; } else if (ret == -2) { GST_WARNING_OBJECT (dec, "Decoding error: corrupted stream?"); - gst_audio_decoder_finish_frame (GST_AUDIO_DECODER (dec), NULL, 1); - gst_buffer_unref (outbuf); + corrupted = TRUE; } if (bits && speex_bits_remaining (bits) < 0) { GST_WARNING_OBJECT (dec, "Decoding overflow: corrupted stream?"); - gst_audio_decoder_finish_frame (GST_AUDIO_DECODER (dec), NULL, 1); - gst_buffer_unref (outbuf); + corrupted = TRUE; } if (dec->header->nb_channels == 2) speex_decode_stereo_int ((spx_int16_t *) map.data, dec->frame_size, @@ -444,7 +442,12 @@ gst_speex_dec_parse_data (GstSpeexDec * dec, GstBuffer * buf) gst_buffer_unmap (outbuf, &map); - res = gst_audio_decoder_finish_frame (GST_AUDIO_DECODER (dec), outbuf, 1); + if (!corrupted) { + res = gst_audio_decoder_finish_frame (GST_AUDIO_DECODER (dec), outbuf, 1); + } else { + res = gst_audio_decoder_finish_frame (GST_AUDIO_DECODER (dec), NULL, 1); + gst_buffer_unref (outbuf); + } if (res != GST_FLOW_OK) { GST_DEBUG_OBJECT (dec, "flow: %s", gst_flow_get_name (res)); -- 2.7.4