A use after free bug in src_v41_set_read.c

[ShangzhiXu]

File: src_v41_set_read.c
Bug Function: src_v4l_open
Version: Git-master

In line 788-792

	if(src->use_read && src_v4l_set_read(src))
	{
		src_v4l_close(src);
		return(-1);
	}

In the src_v4l_set_read, if in line 667 s->buffer = malloc(s->buffer_length); failed, it will release src in line 671 and return -1. So in line 788, if src->use_read != NULL, line 790 will be executed, which will lead to UAF

[fsphil]

Confirmed, and hopefully fixed. Thanks for the report!

[ShangzhiXu]

You are welcome. Have a good day!