From 81408597f496941684db2f058ef9a1dd55954b8d Mon Sep 17 00:00:00 2001 From: Philippe Normand Date: Sat, 22 Mar 2025 18:33:12 +0000 Subject: [PATCH] gst: deviceprovider: Fix a leak and a heap-use-after-free The device passed to gst_device_provider_device_add() is transfer:floating, so we need increase its ref, otherwise the pointer we keep internally will be a dangling ref. Also gst_device_provider_device_remove() doesn't actually release the device, so we have to do it ourselves. Fixes #4616 --- src/gst/gstpipewiredeviceprovider.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/gst/gstpipewiredeviceprovider.c b/src/gst/gstpipewiredeviceprovider.c index c9d0d7ad7..5bdd09b7d 100644 --- a/src/gst/gstpipewiredeviceprovider.c +++ b/src/gst/gstpipewiredeviceprovider.c @@ -327,6 +327,7 @@ static void do_add_nodes(GstPipeWireDeviceProvider *self) gst_object_ref_sink (device), compare_device_session_priority); } else { + gst_object_ref (device); gst_device_provider_device_add (GST_DEVICE_PROVIDER (self), device); } } @@ -484,7 +485,8 @@ destroy_node (void *data) } if (nd->dev != NULL) { - gst_device_provider_device_remove (provider, GST_DEVICE (nd->dev)); + gst_device_provider_device_remove (provider, nd->dev); + gst_clear_object (&nd->dev); } if (nd->caps) gst_caps_unref(nd->caps);