From: jeanlf <jeanlf@gpac.io>
Date: Tue, 8 Feb 2022 15:23:12 +0000 (+0100)
Subject: [PATCH] fixed #2109
X-Git-Tag: archive/raspbian/1.0.1+dfsg1-4+rpi1+deb11u3^2~34
X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=72fa2ae41347c231ee1779385eeca4505cc40fdb;p=gpac.git

[PATCH] fixed #2109


Gbp-Pq: Name CVE-2022-27147.patch
---

diff --git a/include/gpac/internal/scenegraph_dev.h b/include/gpac/internal/scenegraph_dev.h
index 1d80707..7397d5a 100644
--- a/include/gpac/internal/scenegraph_dev.h
+++ b/include/gpac/internal/scenegraph_dev.h
@@ -942,7 +942,7 @@ GF_Err gf_dom_listener_del(GF_Node *listener, GF_DOMEventTarget *target);
 GF_DOMHandler *gf_dom_listener_build_ex(GF_Node *node, u32 event_type, u32 event_parameter, GF_Node *handler, GF_Node **out_listener);
 
 void	gf_dom_event_dump_listeners(GF_Node *n, FILE *f);
-void	gf_dom_event_remove_all_listeners(GF_DOMEventTarget *event_target);
+void	gf_dom_event_remove_all_listeners(GF_DOMEventTarget *event_target, GF_SceneGraph *sg);
 void	gf_dom_event_target_del(GF_DOMEventTarget *target);
 GF_Err	gf_dom_event_remove_listener_from_parent(GF_DOMEventTarget *event_target, GF_Node *listener);
 
diff --git a/src/scenegraph/base_scenegraph.c b/src/scenegraph/base_scenegraph.c
index 9fa77d2..7fa89bc 100644
--- a/src/scenegraph/base_scenegraph.c
+++ b/src/scenegraph/base_scenegraph.c
@@ -364,7 +364,7 @@ void gf_sg_reset(GF_SceneGraph *sg)
 
 	gf_mx_p(sg->dom_evt_mx);
 	/*remove listeners attached to the doc*/
-	gf_dom_event_remove_all_listeners(sg->dom_evt);
+	gf_dom_event_remove_all_listeners(sg->dom_evt, sg);
 	/*flush any pending add_listener*/
 	gf_dom_listener_reset_deferred(sg);
 	gf_mx_v(sg->dom_evt_mx);
@@ -1593,7 +1593,7 @@ void gf_node_free(GF_Node *node)
 		}
 #ifndef GPAC_DISABLE_SVG
 		if (node->sgprivate->interact->dom_evt) {
-			gf_dom_event_remove_all_listeners(node->sgprivate->interact->dom_evt);
+			gf_dom_event_remove_all_listeners(node->sgprivate->interact->dom_evt, node->sgprivate->scenegraph);
 			gf_dom_event_target_del(node->sgprivate->interact->dom_evt);
 		}
 		if (node->sgprivate->interact->animations) {
diff --git a/src/scenegraph/dom_events.c b/src/scenegraph/dom_events.c
index 0fffb9c..b4648ae 100644
--- a/src/scenegraph/dom_events.c
+++ b/src/scenegraph/dom_events.c
@@ -189,11 +189,15 @@ GF_Err gf_dom_event_remove_listener_from_parent(GF_DOMEventTarget *event_target,
 	return GF_OK;
 }
 
-void gf_dom_event_remove_all_listeners(GF_DOMEventTarget *event_target)
+void gf_dom_event_remove_all_listeners(GF_DOMEventTarget *event_target, GF_SceneGraph *sg)
 {
 	while (gf_list_count(event_target->listeners)) {
 		GF_Node *n = (GF_Node *)gf_list_get(event_target->listeners, 0);
-		gf_dom_listener_del(n, event_target);
+		if (gf_list_find(sg->exported_nodes, n)>=0) {
+			gf_list_rem(event_target->listeners, 0);
+		} else {
+			gf_dom_listener_del(n, event_target);
+		}
 	}
 }