Win Video Capture: Check returned AM_MEDIA_TYPE pointer before comparing it.

media/video/capture/win/video_capture_device_factory_win.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "media/video/capture/win/video_capture_device_factory_win.h"
 
 #include <mfapi.h>
 #include <mferror.h>
 
 #include "base/command_line.h"
@@ skipping 257 matching lines @@
                 << logging::SystemErrorCodeToString(hr);
     return;
   }
 
   scoped_ptr<BYTE[]> caps(new BYTE[size]);
   for (int i = 0; i < count; ++i) {
     VideoCaptureDeviceWin::ScopedMediaType media_type;
     hr = stream_config->GetStreamCaps(i, media_type.Receive(), caps.get());
     // GetStreamCaps() may return S_FALSE, so don't use FAILED() or SUCCEED()
     // macros here since they'll trigger incorrectly.
-    if (hr != S_OK) {
+    if (hr != S_OK || !media_type.get()) {

[tommi (sloooow) - chröme, 2014/10/15 17:23:30]

FYI - I checked the bug and just to confirm - this is exactly what's happening. 
The pointer isn't set by the implementation (which incorrectly returns S_OK), so
media_type wraps a NULL pointer to AM_MEDIA_TYPE and then we attempt to check
the |majortype| member, which is the first member variable of the struct (i.e.
offset 0 from the pointer), and we subsequently deref NULL.

       DLOG(ERROR) << "GetStreamCaps failed: "
                   << logging::SystemErrorCodeToString(hr);
       return;
     }
 
     if (media_type->majortype == MEDIATYPE_Video &&
         media_type->formattype == FORMAT_VideoInfo) {
       VideoCaptureFormat format;
       format.pixel_format =
           VideoCaptureDeviceWin::TranslateMediaSubtypeToPixelFormat(
@@ skipping 164 matching lines @@
     const Name& device,
     VideoCaptureFormats* formats) {
   DCHECK(thread_checker_.CalledOnValidThread());
   if (use_media_foundation_)
     GetDeviceSupportedFormatsMediaFoundation(device, formats);
   else
     GetDeviceSupportedFormatsDirectShow(device, formats);
 }
 
 }  // namespace media