From: Jaroslav Kysela <perex@perex.cz>
Date: Tue, 25 Jul 2017 12:25:51 +0000 (+0200)
Subject: dvr: fix the wrong idnode class usage (memory access), fixes #4480
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=3518a0d88702be20aed5f567befd3806a30b9f21;p=thirdparty%2Ftvheadend.git

dvr: fix the wrong idnode class usage (memory access), fixes #4480
---

diff --git a/src/api.h b/src/api.h
index 2a56bf356..6636540cd 100644
--- a/src/api.h
+++ b/src/api.h
@@ -114,7 +114,7 @@ int api_idnode_load_by_class
   ( access_t *perm, void *opaque, const char *op, htsmsg_t *args, htsmsg_t **resp );
 
 int api_idnode_handler
-  ( access_t *perm, htsmsg_t *args, htsmsg_t **resp,
+  ( const idclass_t *idc, access_t *perm, htsmsg_t *args, htsmsg_t **resp,
     void (*handler)(access_t *perm, idnode_t *in), const char *op, int destroyed );
 
 int api_idnode_load_simple
diff --git a/src/api/api_dvr.c b/src/api/api_dvr.c
index b57a5c01d..8bf884cc8 100644
--- a/src/api/api_dvr.c
+++ b/src/api/api_dvr.c
@@ -264,7 +264,7 @@ static int
 api_dvr_entry_rerecord_toggle
   ( access_t *perm, void *opaque, const char *op, htsmsg_t *args, htsmsg_t **resp )
 {
-  return api_idnode_handler(perm, args, resp, api_dvr_rerecord_toggle, "rerecord", 0);
+  return api_idnode_handler(&dvr_entry_class, perm, args, resp, api_dvr_rerecord_toggle, "rerecord", 0);
 }
 
 static void
@@ -277,7 +277,7 @@ static int
 api_dvr_entry_rerecord_deny
   ( access_t *perm, void *opaque, const char *op, htsmsg_t *args, htsmsg_t **resp )
 {
-  return api_idnode_handler(perm, args, resp, api_dvr_rerecord_deny, "rerecord", 0);
+  return api_idnode_handler(&dvr_entry_class, perm, args, resp, api_dvr_rerecord_deny, "rerecord", 0);
 }
 
 static void
@@ -290,7 +290,7 @@ static int
 api_dvr_entry_rerecord_allow
   ( access_t *perm, void *opaque, const char *op, htsmsg_t *args, htsmsg_t **resp )
 {
-  return api_idnode_handler(perm, args, resp, api_dvr_rerecord_allow, "rerecord", 0);
+  return api_idnode_handler(&dvr_entry_class, perm, args, resp, api_dvr_rerecord_allow, "rerecord", 0);
 }
 
 static void
@@ -303,7 +303,7 @@ static int
 api_dvr_entry_stop
   ( access_t *perm, void *opaque, const char *op, htsmsg_t *args, htsmsg_t **resp )
 {
-  return api_idnode_handler(perm, args, resp, api_dvr_stop, "stop", 0);
+  return api_idnode_handler(&dvr_entry_class, perm, args, resp, api_dvr_stop, "stop", 0);
 }
 
 static void
@@ -316,7 +316,7 @@ static int
 api_dvr_entry_cancel
   ( access_t *perm, void *opaque, const char *op, htsmsg_t *args, htsmsg_t **resp )
 {
-  return api_idnode_handler(perm, args, resp, api_dvr_cancel, "cancel", 0);
+  return api_idnode_handler(&dvr_entry_class, perm, args, resp, api_dvr_cancel, "cancel", 0);
 }
 
 static void
@@ -331,7 +331,7 @@ static int
 api_dvr_entry_remove
   ( access_t *perm, void *opaque, const char *op, htsmsg_t *args, htsmsg_t **resp )
 {
-  return api_idnode_handler(perm, args, resp, api_dvr_remove, "remove", 0);
+  return api_idnode_handler(&dvr_entry_class, perm, args, resp, api_dvr_remove, "remove", 0);
 }
 
 static void
@@ -344,7 +344,7 @@ static int
 api_dvr_entry_move_finished
   ( access_t *perm, void *opaque, const char *op, htsmsg_t *args, htsmsg_t **resp )
 {
-  return api_idnode_handler(perm, args, resp, api_dvr_move_finished, "move finished", 0);
+  return api_idnode_handler(&dvr_entry_class, perm, args, resp, api_dvr_move_finished, "move finished", 0);
 }
 
 static void
@@ -357,7 +357,7 @@ static int
 api_dvr_entry_move_failed
   ( access_t *perm, void *opaque, const char *op, htsmsg_t *args, htsmsg_t **resp )
 {
-  return api_idnode_handler(perm, args, resp, api_dvr_move_failed, "move failed", 0);
+  return api_idnode_handler(&dvr_entry_class, perm, args, resp, api_dvr_move_failed, "move failed", 0);
 }
 
 static void
diff --git a/src/api/api_idnode.c b/src/api/api_idnode.c
index 5f094effc..fe7b42623 100644
--- a/src/api/api_idnode.c
+++ b/src/api/api_idnode.c
@@ -610,7 +610,8 @@ exit:
 
 int
 api_idnode_handler
-  ( access_t *perm, htsmsg_t *args, htsmsg_t **resp,
+  ( const idclass_t *idc,
+    access_t *perm, htsmsg_t *args, htsmsg_t **resp,
     void (*handler)(access_t *perm, idnode_t *in),
     const char *op, int destroyed )
 {
@@ -636,7 +637,7 @@ api_idnode_handler
     HTSMSG_FOREACH(f, uuids) {
       if (!(uuid = htsmsg_field_get_string(f))) continue;
       pthread_mutex_lock(&global_lock);
-      if ((in = idnode_find(uuid, NULL, domain)) != NULL) {
+      if ((in = idnode_find(uuid, idc, domain)) != NULL) {
         domain = in->in_domain;
         if (idnode_perm(in, perm, msg)) {
           pthread_mutex_unlock(&global_lock);
@@ -661,7 +662,7 @@ api_idnode_handler
   } else {
     uuid = htsmsg_field_get_string(f);
     pthread_mutex_lock(&global_lock);
-    if (!(in   = idnode_find(uuid, NULL, NULL))) {
+    if (!(in   = idnode_find(uuid, idc, NULL))) {
       err = ENOENT;
     } else {
       msg = htsmsg_create_map();
@@ -692,7 +693,7 @@ static int
 api_idnode_delete
   ( access_t *perm, void *opaque, const char *op, htsmsg_t *args, htsmsg_t **resp )
 {
-  return api_idnode_handler(perm, args, resp, api_idnode_delete_, "delete", 1);
+  return api_idnode_handler(NULL, perm, args, resp, api_idnode_delete_, "delete", 1);
 }
 
 static void
@@ -705,7 +706,7 @@ static int
 api_idnode_moveup
   ( access_t *perm, void *opaque, const char *op, htsmsg_t *args, htsmsg_t **resp )
 {
-  return api_idnode_handler(perm, args, resp, api_idnode_moveup_, "moveup", 0);
+  return api_idnode_handler(NULL, perm, args, resp, api_idnode_moveup_, "moveup", 0);
 }
 
 static void
@@ -718,7 +719,7 @@ static int
 api_idnode_movedown
   ( access_t *perm, void *opaque, const char *op, htsmsg_t *args, htsmsg_t **resp )
 {
-  return api_idnode_handler(perm, args, resp, api_idnode_movedown_, "movedown", 0);
+  return api_idnode_handler(NULL, perm, args, resp, api_idnode_movedown_, "movedown", 0);
 }
 
 void