[PATCH] fixed #2109

Gbp-Pq: Name CVE-2022-27147.patch

diff --git a/include/gpac/internal/scenegraph_dev.h b/include/gpac/internal/scenegraph_dev.h
index 1d80707df654b3e0f85b27267daf8327326be460..7397d5ad4731e650a2517bf947381c8a2985e96c 100644 (file)
--- a/include/gpac/internal/scenegraph_dev.h
+++ b/include/gpac/internal/scenegraph_dev.h
@@ -942,7 +942,7 @@ GF_Err gf_dom_listener_del(GF_Node *listener, GF_DOMEventTarget *target);
 GF_DOMHandler *gf_dom_listener_build_ex(GF_Node *node, u32 event_type, u32 event_parameter, GF_Node *handler, GF_Node **out_listener);
 
 void   gf_dom_event_dump_listeners(GF_Node *n, FILE *f);
-void   gf_dom_event_remove_all_listeners(GF_DOMEventTarget *event_target);
+void   gf_dom_event_remove_all_listeners(GF_DOMEventTarget *event_target, GF_SceneGraph *sg);
 void   gf_dom_event_target_del(GF_DOMEventTarget *target);
 GF_Err gf_dom_event_remove_listener_from_parent(GF_DOMEventTarget *event_target, GF_Node *listener);
 

diff --git a/src/scenegraph/base_scenegraph.c b/src/scenegraph/base_scenegraph.c
index 9fa77d28568e8974a3eef8e6254b9ea0ec2ecdd6..7fa89bcf36f22082112503137bc3e1ba157c98fb 100644 (file)
--- a/src/scenegraph/base_scenegraph.c
+++ b/src/scenegraph/base_scenegraph.c
@@ -364,7 +364,7 @@ void gf_sg_reset(GF_SceneGraph *sg)
 
        gf_mx_p(sg->dom_evt_mx);
        /*remove listeners attached to the doc*/
-       gf_dom_event_remove_all_listeners(sg->dom_evt);
+       gf_dom_event_remove_all_listeners(sg->dom_evt, sg);
        /*flush any pending add_listener*/
        gf_dom_listener_reset_deferred(sg);
        gf_mx_v(sg->dom_evt_mx);
@@ -1593,7 +1593,7 @@ void gf_node_free(GF_Node *node)
                }
 #ifndef GPAC_DISABLE_SVG
                if (node->sgprivate->interact->dom_evt) {
-                       gf_dom_event_remove_all_listeners(node->sgprivate->interact->dom_evt);
+                       gf_dom_event_remove_all_listeners(node->sgprivate->interact->dom_evt, node->sgprivate->scenegraph);
                        gf_dom_event_target_del(node->sgprivate->interact->dom_evt);
                }
                if (node->sgprivate->interact->animations) {

diff --git a/src/scenegraph/dom_events.c b/src/scenegraph/dom_events.c
index 0fffb9c6138783c14557e991b3fdc97635430710..b4648aebbc2a596ca14dd26b38a1fabc1e352895 100644 (file)
--- a/src/scenegraph/dom_events.c
+++ b/src/scenegraph/dom_events.c
@@ -189,11 +189,15 @@ GF_Err gf_dom_event_remove_listener_from_parent(GF_DOMEventTarget *event_target,
        return GF_OK;
 }
 
-void gf_dom_event_remove_all_listeners(GF_DOMEventTarget *event_target)
+void gf_dom_event_remove_all_listeners(GF_DOMEventTarget *event_target, GF_SceneGraph *sg)
 {
        while (gf_list_count(event_target->listeners)) {
                GF_Node *n = (GF_Node *)gf_list_get(event_target->listeners, 0);
-               gf_dom_listener_del(n, event_target);
+               if (gf_list_find(sg->exported_nodes, n)>=0) {
+                       gf_list_rem(event_target->listeners, 0);
+               } else {
+                       gf_dom_listener_del(n, event_target);
+               }
        }
 }