When an flite filter instance is uninitialized and the refcount of the corresponding voice_entry reaches zero, the voice is unregistered, yet the voice_entry's pointer to the voice is not reset. (Whereas some other pointers are needlessly reset.) Because of this a new flite filter instance will believe said voice to already be registered, leading to use-after-frees. Fix this by resetting the right pointer instead of the wrong ones.
Showing the changes to libavfilter (1 of 1 file). Show all
Unified · Split
| @@ -197,10 +197,10 @@ static av_cold void uninit(AVFilterContext *ctx) · 196 unmodified lines | ||
| 197 | 197 | FliteContext *flite = ctx->priv; |
| 198 | 198 | |
| 199 | 199 | if (flite->voice_entry) { |
| 200 | − if (!--flite->voice_entry->usage_count) | |
| 200 | + if (!--flite->voice_entry->usage_count) { | |
| 201 | 201 | flite->voice_entry->unregister_fn(flite->voice); |
| 202 | − flite->voice = NULL; | |
| 203 | − flite->voice_entry = NULL; | |
| 202 | + flite->voice_entry->voice = NULL; | |
| 203 | + } | |
| 204 | 204 | } |
| 205 | 205 | delete_wave(flite->wave); |
| 206 | 206 | flite->wave = NULL; |