When an flite filter instance is uninitialized and the refcount of the corresponding voice_entry reaches zero, the voice is unregistered, yet the voice_entry's pointer to the voice is not reset. (Whereas some other pointers are needlessly reset.) Because of this a new flite filter instance will believe said voice to already be registered, leading to use-after-frees. Fix this by resetting the right pointer instead of the wrong ones.
Showing the changes to libavfilter (1 of 1 file). Show all
Unified · Split
| @@ -197,10 +197,10 @@ static av_cold void uninit(AVFilterContext *ctx) · 196 unmodified lines | |||
| 197 | FliteContext *flite = ctx->priv; | 197 | FliteContext *flite = ctx->priv; |
| 198 | 198 | ||
| 199 | if (flite->voice_entry) { | 199 | if (flite->voice_entry) { |
| 200 | if (!--flite->voice_entry->usage_count) | 200 | if (!--flite->voice_entry->usage_count) { |
| 201 | flite->voice_entry->unregister_fn(flite->voice); | 201 | flite->voice_entry->unregister_fn(flite->voice); |
| 202 | flite->voice = NULL; | 202 | flite->voice_entry->voice = NULL; |
| 203 | flite->voice_entry = NULL; | 203 | } |
| 204 | } | 204 | } |
| 205 | delete_wave(flite->wave); | 205 | delete_wave(flite->wave); |
| 206 | flite->wave = NULL; | 206 | flite->wave = NULL; |