commit f887db4ab1d7bae188cd447531cbbb068ec28da6
author Tim-Philipp Müller <tim@centricular.com> Sat May 05 16:16:45 2018 +0200
committer Tim-Philipp Müller <tim@centricular.com> Sat May 05 16:28:04 2018 +0200
tree 2f5cca84eaceb6ded67b04b28b47125f16f6cc74
parent c97c95fc60b3814197853eda42619665f4498b54

bufferlist: fix abort due to underflow when creating 0-sized list

gst_buffer_list_new_sized(0) will cause an underflow in a calculation
which then makes it try to allocate huge amounts of memory, which
may lead to aborts.

https://bugzilla.gnome.org/show_bug.cgi?id=795758

gst/gstbufferlist.c

diff --git a/gst/gstbufferlist.c b/gst/gstbufferlist.c
index 9ca4d87..16de4ce 100644
--- a/gst/gstbufferlist.c
+++ b/gst/gstbufferlist.c
@@ -149,6 +149,9 @@
   gsize slice_size;
   guint n_allocated;
 
+  if (size == 0)
+    size = 1;
+
   n_allocated = GST_ROUND_UP_16 (size);
 
   slice_size = sizeof (GstBufferList) + (n_allocated - 1) * sizeof (gpointer);

tests/check/gst/gstbufferlist.c

diff --git a/tests/check/gst/gstbufferlist.c b/tests/check/gst/gstbufferlist.c
index 54e7257..2ac3323 100644
--- a/tests/check/gst/gstbufferlist.c
+++ b/tests/check/gst/gstbufferlist.c
@@ -474,6 +474,15 @@
 
 GST_END_TEST;
 
+GST_START_TEST (test_new_sized_0)
+{
+  GstBufferList *b = gst_buffer_list_new_sized (0);
+
+  gst_buffer_list_unref (b);
+}
+
+GST_END_TEST;
+
 static Suite *
 gst_buffer_list_suite (void)
 {
@@ -491,6 +500,7 @@
   tcase_add_test (tc_chain, test_expand_and_remove);
   tcase_add_test (tc_chain, test_get_writable);
   tcase_add_test (tc_chain, test_calc_size);
+  tcase_add_test (tc_chain, test_new_sized_0);
 
   return s;
 }