1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
|
https://bugs.gentoo.org/974284
https://gstreamer.freedesktop.org/security/sa-2026-0013.html
https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11240
From 9a4bef4892c23b9d156f810d5e1a18ffc774a595 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
Date: Thu, 26 Mar 2026 18:31:05 +0200
Subject: [PATCH 1/2] h264parse: Remove pointless allocation failure handling
g_new0() already aborts the process on allocation failure.
Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11240>
--- a/gst-libs/gst/codecparsers/gsth264parser.c
+++ b/gst-libs/gst/codecparsers/gsth264parser.c
@@ -2044,8 +2044,6 @@ gst_h264_parse_sps_mvc_data (NalReader * nr, GstH264SPS * sps)
READ_UE_MAX (nr, mvc->num_views_minus1, GST_H264_MAX_VIEW_COUNT - 1);
mvc->view = g_new0 (GstH264SPSExtMVCView, mvc->num_views_minus1 + 1);
- if (!mvc->view)
- goto error_allocation_failed;
for (i = 0; i <= mvc->num_views_minus1; i++)
READ_UE_MAX (nr, mvc->view[i].view_id, GST_H264_MAX_VIEW_ID);
@@ -2083,8 +2081,6 @@ gst_h264_parse_sps_mvc_data (NalReader * nr, GstH264SPS * sps)
mvc->level_value =
g_new0 (GstH264SPSExtMVCLevelValue,
mvc->num_level_values_signalled_minus1 + 1);
- if (!mvc->level_value)
- goto error_allocation_failed;
for (i = 0; i <= mvc->num_level_values_signalled_minus1; i++) {
GstH264SPSExtMVCLevelValue *const level_value = &mvc->level_value[i];
@@ -2095,8 +2091,6 @@ gst_h264_parse_sps_mvc_data (NalReader * nr, GstH264SPS * sps)
level_value->applicable_op =
g_new0 (GstH264SPSExtMVCLevelValueOp,
level_value->num_applicable_ops_minus1 + 1);
- if (!level_value->applicable_op)
- goto error_allocation_failed;
for (j = 0; j <= level_value->num_applicable_ops_minus1; j++) {
GstH264SPSExtMVCLevelValueOp *const op = &level_value->applicable_op[j];
@@ -2105,8 +2099,6 @@ gst_h264_parse_sps_mvc_data (NalReader * nr, GstH264SPS * sps)
READ_UE_MAX (nr, op->num_target_views_minus1, 1023);
op->target_view_id = g_new (guint16, op->num_target_views_minus1 + 1);
- if (!op->target_view_id)
- goto error_allocation_failed;
for (k = 0; k <= op->num_target_views_minus1; k++)
READ_UE_MAX (nr, op->target_view_id[k], GST_H264_MAX_VIEW_ID);
@@ -2115,11 +2107,6 @@ gst_h264_parse_sps_mvc_data (NalReader * nr, GstH264SPS * sps)
}
return TRUE;
-error_allocation_failed:
- GST_WARNING ("failed to allocate memory");
- gst_h264_sps_clear (sps);
- return FALSE;
-
error:
gst_h264_sps_clear (sps);
return FALSE;
--
GitLab
From 1f823ee39f253fc23ad95e6833281146cad8ecad Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
Date: Thu, 26 Mar 2026 18:37:50 +0200
Subject: [PATCH 2/2] h264parse: Avoid NULL pointer dereferences when freeing
partially parsed SPS/MVC data
Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/4992
Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11240>
--- a/gst-libs/gst/codecparsers/gsth264parser.c
+++ b/gst-libs/gst/codecparsers/gsth264parser.c
@@ -2623,15 +2623,19 @@ gst_h264_sps_mvc_clear (GstH264SPS * sps)
g_free (mvc->view);
mvc->view = NULL;
- for (i = 0; i <= mvc->num_level_values_signalled_minus1; i++) {
- GstH264SPSExtMVCLevelValue *const level_value = &mvc->level_value[i];
-
- for (j = 0; j <= level_value->num_applicable_ops_minus1; j++) {
- g_free (level_value->applicable_op[j].target_view_id);
- level_value->applicable_op[j].target_view_id = NULL;
+ if (mvc->level_value) {
+ for (i = 0; i <= mvc->num_level_values_signalled_minus1; i++) {
+ GstH264SPSExtMVCLevelValue *const level_value = &mvc->level_value[i];
+
+ if (level_value->applicable_op) {
+ for (j = 0; j <= level_value->num_applicable_ops_minus1; j++) {
+ g_free (level_value->applicable_op[j].target_view_id);
+ level_value->applicable_op[j].target_view_id = NULL;
+ }
+ }
+ g_free (level_value->applicable_op);
+ level_value->applicable_op = NULL;
}
- g_free (level_value->applicable_op);
- level_value->applicable_op = NULL;
}
g_free (mvc->level_value);
mvc->level_value = NULL;
--
GitLab
|
