tag/Builder: don't ignore the result of tag_pool_dup_item

Also, use RemoveAll() instead of directly clearing TagBuilder::items in most cases, as its elements represent references that must be released. Closes #1023

tag/Builder: don't ignore the result of tag_pool_dup_item
551c941b · Cebtenzzre · Max Kellermann · 624c77ab · 551c941b · 551c941b
Commit 551c941b authored Jun 23, 2021 by Cebtenzzre Committed by Max Kellermann Aug 05, 2021
Hide whitespace changes
Inline Side-by-side

Showing with 6 additions and 2 deletions

NEWS NEWS +2 -0

Builder.cxx src/tag/Builder.cxx +4 -2

No files found.
--- a/NEWS
+++ b/NEWS
@@ -6,6 +6,8 @@ ver 0.22.10 (not yet released)
 * input
  - curl: fix crash bug after stream with Icy metadata was closed by peer
  - tidal: remove defunct unmaintained plugin
+* tags
+  - fix crash caused by bug in TagBuilder and a few potential reference leaks
 ver 0.22.9 (2021/06/23)
 * database

--- a/src/tag/Builder.cxx
+++ b/src/tag/Builder.cxx
@@ -69,8 +69,8 @@ TagBuilder::operator=(const TagBuilder &other) noexcept
 	/* increment the tag pool refcounters */
 	const std::lock_guard<Mutex> protect(tag_pool_lock);
-	for (auto i : items)
+	for (auto &i : items)
-		tag_pool_dup_item(i);
+		i = tag_pool_dup_item(i);
 	return *this;
 }
@@ -80,6 +80,8 @@ TagBuilder::operator=(TagBuilder &&other) noexcept
 {
 	duration = other.duration;
 	has_playlist = other.has_playlist;
+	RemoveAll();
 	items = std::move(other.items);
 	return *this;