griefith/test
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Fix possible use after free in VSE cache

Browse Source 
Use `BLI_ghash_insert` instead of `BLI_ghash_reinsert` to store images.

VSE links stored cache keys for each frame in style of linked list.
These links must be maintained when any image/key is removed from the
cache. Reinserting can free key without proper relinking, which would
lead to accessing this freed key when cache limiting frees images in
a frame.

This should not happen since reinserting is prevented in
`seq_cache_put()`, but it's safer to assert, that key is not stored in
hash instead.
This commit is contained in:
Richard Antalik
2023-07-11 08:30:03 +02:00
parent c728fa0663
commit 02c87b1740
1 changed files with 6 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
source/blender/sequencer/intern/image_cache.c
View File

@@ -235,15 +235,15 @@ static void seq_cache_put_ex(Scene *scene, SeqCacheKey *key, ImBuf *ibuf)
key->link_prev = cache->last_key;
}
BLI_assert(!BLI_ghash_haskey(cache->hash, key));
BLI_ghash_insert(cache->hash, key, item);
IMB_refImBuf(ibuf);
/* Store pointer to last cached key. */
SeqCacheKey *temp_last_key = cache->last_key;
if (BLI_ghash_reinsert(cache->hash, key, item, seq_cache_keyfree, seq_cache_valfree)) {
IMB_refImBuf(ibuf);
if (!key->is_temp_cache || key->type != SEQ_CACHE_STORE_THUMBNAIL) {
cache->last_key = key;
}
if (!key->is_temp_cache || key->type != SEQ_CACHE_STORE_THUMBNAIL) {
cache->last_key = key;
}
/* Set last_key's reference to this key so we can look up chain backwards.