From: jeanlf <jeanlf@gpac.io>
Date: Mon, 13 Dec 2021 13:21:50 +0000 (+0100)
Subject: [PATCH] fixed #1980
X-Git-Tag: archive/raspbian/1.0.1+dfsg1-4+rpi1+deb11u3^2~62
X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=a83cb4cb20f2bbb19033ea342530b7d1d50d7dfb;p=gpac.git

[PATCH] fixed #1980


Gbp-Pq: Name CVE-2021-45262.patch
---

diff --git a/include/gpac/svg_types.h b/include/gpac/svg_types.h
index cd83e59..51c9b67 100644
--- a/include/gpac/svg_types.h
+++ b/include/gpac/svg_types.h
@@ -176,6 +176,9 @@ enum {
 	LASeR_Size_datatype,
 
 	SVG_Matrix2D_datatype,
+
+	/*internal type for node list*/
+	SVG_NodeList_datatype
 };
 
 //! @cond Doxygen_Suppress
diff --git a/src/laser/lsr_dec.c b/src/laser/lsr_dec.c
index d0ae262..79ccb18 100644
--- a/src/laser/lsr_dec.c
+++ b/src/laser/lsr_dec.c
@@ -5252,6 +5252,7 @@ static GF_Err lsr_read_add_replace_insert(GF_LASeRCodec *lsr, GF_List *com_list,
 				gf_node_register(field->new_node, NULL);
 				if (att_type>=0) field->fieldIndex = gf_lsr_anim_type_to_attribute(att_type);
 			} else {
+				field->fieldType = SVG_NodeList_datatype;
 				field->field_ptr = &field->node_list;
 				while (count) {
 					GF_Node *new_node = lsr_read_update_content_model(lsr, (SVG_Element *) n);
diff --git a/src/scenegraph/svg_types.c b/src/scenegraph/svg_types.c
index 1975287..2d2fc3c 100644
--- a/src/scenegraph/svg_types.c
+++ b/src/scenegraph/svg_types.c
@@ -487,6 +487,8 @@ void gf_svg_delete_attribute_value(u32 type, void *value, GF_SceneGraph *sg)
 		if (*(SVG_String *)value) gf_free(*(SVG_String *)value);
 		gf_free(value);
 		break;
+	case SVG_NodeList_datatype:
+		break;
 	case SMIL_RepeatCount_datatype:
 	case SMIL_Duration_datatype:
 	case SVG_Length_datatype:
diff --git a/src/scenegraph/vrml_tools.c b/src/scenegraph/vrml_tools.c
index bd299cc..26bec0e 100644
--- a/src/scenegraph/vrml_tools.c
+++ b/src/scenegraph/vrml_tools.c
@@ -1133,7 +1133,7 @@ GF_Err gf_sg_vrml_mf_reset(void *mf, u32 FieldType)
 		gf_sg_mfurl_del( * ((MFURL *) mf));
 		break;
 	case GF_SG_VRML_MFSCRIPT:
-		gf_sg_mfscript_del( * ((MFScript *) mf));
+		gf_sg_mfscript_del( * ((MFScript *) mf));	
 		break;
 	default:
 		if (mffield->array) gf_free(mffield->array);